All Apps and Add-ons

Splunk App for Salesforce: After creating a query for a custom object, how to troubleshoot why it's not pulling all records?

bi0ekcc
New Member

We created a new query for a custom object in Salesforce. We are only returning 312 records back, when we should have around 2596 .
Our query limit is 1000. How can we tell why it's not pulling everything back? We've tested the same query with the Splunk Salesforce user and it's returning the correct amount of records. Does the input paginate correctly?

Is there any troubleshooting we can look at to tell us what query it is running against Salesforce, the raw results, and other information.

In addition, how does the query limit work? Does it just append a LIMIT onto the sql query, or does it also count against a sub-select?

0 Karma

agabrielli
Loves-to-Learn

Hi guys, I 'm having the same issue.

The connector retrieves up 2000 records. I've configured both "Order By" and "Query Start Date Parameters"  = 10000 but it doesn't work. The event I'm trying to sync is LoginEvent.

Which configuration do I need to perform to be sure to retrieves all the thousands of generated events?

0 Karma

chustwayte
Explorer

I have experienced this a couple times as well. I recently just indexed over a million rows within Multiple sourcetypes and found that if you don't have a good start date or order by field that you can get incomplete results. I've tried this a few times with different types of queries and have been successfull with all attempts since making sure I have this information. Good Luck!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...