All Apps and Add-ons

Splunk App for Salesforce: After creating a query for a custom object, how to troubleshoot why it's not pulling all records?

New Member

We created a new query for a custom object in Salesforce. We are only returning 312 records back, when we should have around 2596 .
Our query limit is 1000. How can we tell why it's not pulling everything back? We've tested the same query with the Splunk Salesforce user and it's returning the correct amount of records. Does the input paginate correctly?

Is there any troubleshooting we can look at to tell us what query it is running against Salesforce, the raw results, and other information.

In addition, how does the query limit work? Does it just append a LIMIT onto the sql query, or does it also count against a sub-select?

0 Karma


Hi guys, I 'm having the same issue.

The connector retrieves up 2000 records. I've configured both "Order By" and "Query Start Date Parameters"  = 10000 but it doesn't work. The event I'm trying to sync is LoginEvent.

Which configuration do I need to perform to be sure to retrieves all the thousands of generated events?

0 Karma


I have experienced this a couple times as well. I recently just indexed over a million rows within Multiple sourcetypes and found that if you don't have a good start date or order by field that you can get incomplete results. I've tried this a few times with different types of queries and have been successfull with all attempts since making sure I have this information. Good Luck!

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...