We are using "Splunk Add-on for Salesforce" to pull the SalesForce event logs from SalesForce.
Logs are updated hourly and daily at the SalesForce. At Splunk Heavy Forwarder, inputs are configured with interval of 1 hour (3600 seconds). But Splunk is receiving those logs on a daily basis only even though it is configured to receive hourly.
Not sure what the problem is.