topic Salesforce UserLicense Events in Splunk Search

Salesforce UserLicense Events

vishalduttauk — Fri, 04 Apr 2025 14:04:08 GMT

I have been using the Splunk Add on for Salesforce Add on for while now but i want to know if anyone else is using it and noticed if the number of events being ingesting has decreased?

When i look back to December i could see i could see Splunk would ingest mutiple UserLicense events per day but now its one event every 4 days.

Re: Salesforce UserLicense Events

livehybrid — Fri, 04 Apr 2025 21:49:09 GMT

Hi @vishalduttauk

Can you confirm what the interval of your inputs are configured for this data feed? Does it run every 24 hours?

I think it would be worth looking in the _internal index for errors coming from the add-on incase there is an issue here

You could start out with something like the below and then narrow down as necessary:

index=_interna logLvel=error *salesforce*

🌟 Did this answer help you? If so, please consider:

Adding kudos to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Salesforce UserLicense Events

vishalduttauk — Tue, 08 Apr 2025 08:08:02 GMT

Hi @livehybrid

The interval is set to every 60 minutes and there are no errors logged against the internal index.