Splunk AddOn for Salesforce UserAccountId field

[aryne]

Hi,

We are using Splunk to query the LoginHistory object from our Salesforce org. In the login report, there are two fields : UserId and UserAccountId. May I know what values do these two fields refer to? Sometimes they have same values, sometimes they have different values.

Per following release note from Splunk AddOns, it stated "Version 2.0.0 of the Splunk Add-on for Salesforce supports multiple accounts or custom endpoints. Therefore, there is a new field in version 2.0.0 called UserAccountId."

https://docs.splunk.com/Documentation/AddOns/released/Salesforce/Releasehistory

What is this UserAccountId refer to in a LoginHistory record?

Thanks,
Aryne

[nickhills]

This add on now allows you to collect data from multiple salesforce accounts. i.e companyA, companyB etc

The UserAccountId indicates from which Salesforce Account the events have come from:

[aryne]

Hello @nickhillscpl ,

Thanks for the information. 🙂

Based on my understanding of your answer, UserAccountId should refer to the Id of an Account object record.

However, in this output that I get, both UserId and UserAccountId referred to the Id of a User object/record.

Link to image : https://ibb.co/yNhZFCW

From my research, the user indicated in UserId was the actual logged in user (it has a matching record in the Login History list).

However, I am not sure how the user in UserAccountId was associated to this record in this case. There is no matching record in the Login History which shows that this user logged in to the specific url at the specific timestamps. Based on this user's login history, he/she mainly logs in via SOAP Partner API. Can you help us understand this scenario please?

On other scenarios, the UserId and UserAccountId often shows the same values. Hence this is rather confusing for us to try to figure out what the UserAccountId field actually means.

Thanks in advanced for your help.

Regards,
Aryne

[aryne]

Can someone from Splunk Add-On Support Team please enlighten me about this? The documentation about UserAccountId field is not clear enough, it would be great if it states which exact source field in Salesforce it is mapped to.

Thanks in advance!

[pocfabienbnc]

Hi there,

Gradually Salesforce is deploying the concept of "Person Accounts" in their clouds.

From a Salesforce point of view, a user is also a Person. Hence this User may hold a PersonAccount record.

The ID itself represents the unique ID from the user object, and the UserAccountId represents the corresponding PersonAccount (from the Account object), if any.

HTH,

[aryne]

Hi @pocfabienbnc ,

Thank you very much for the clarification. 🙂

That answered my question.

Regards,
Aryne