topic Re: Salesforce in SPLUNK in Splunk Search

Salesforce in SPLUNK

linaaabad — Thu, 14 Nov 2024 18:08:29 GMT

I am confused on why I only get _ID's from my Salesforce ingest, for example, I am not getting Username, Profile Name, Dashboard Name, Report Names...etc...I am getting the User ID, Profile ID, Dashboard ID, and so fourth, it makes searches really difficult...How am I to correlate the ID to readable relevant information.? Where User_ID equates to Username (Davey Jones)? Help Please.

Re: Salesforce in SPLUNK

yuanliu — Fri, 15 Nov 2024 05:59:57 GMT

There might be a Salesforce app that can manage ingestion and extraction. Short of that, if you are certain that ingestion is complete, you can post sample events (anonymize as needed) so volunteers can help.

Re: Salesforce in SPLUNK

Gr0und_Z3r0 — Mon, 18 Nov 2024 13:01:12 GMT

In the salesforce app for splunk, there's a lookup you can use to get the mapping of user ids and user names. Use the following apps for ingestion of Salesforce events & objects. For stream events, use the streaming app.

Splunk Add-on for Salesforce -> https://splunkbase.splunk.com/app/3549

Splunk Add-on for Salesforce Streaming API -> https://splunkbase.splunk.com/app/5689

Splunk App for Salesforce -> https://splunkbase.splunk.com/app/1931