All Apps and Add-ons

Splunk App for Salesforce Eventlog limiter for query start date: What is the time format for limiting events?

bandit
Motivator

Under Settings » Data inputs » Salesforce Event Log » EventLog

Get event log data from Salesforce.com.
Query Start Date:The initial date/time to use for the first query. If nothing is specified, the query will default to starting 90 days prior the date of the first run.

I tried the following to ignore Eventlog events earlier than 2/1/16, however it still receive events prior to that date.
2016-02-01T00:00:00.000Z
and
1454284800000 (epoch time for Mon, 01 Feb 2016 00:00:00 GMT)

0 Karma

kaydub00
Explorer

Just want to point out, the correct format is only accepted with a lowercase z.

2016-02-01T00:00:00.000z

0 Karma

bandit
Motivator

This appears to be the correct format. 2016-02-01T00:00:00.000Z

The issue was that the constraint is only honored for a new input setup . Changes are ignored if you edit after the setup. Workaround was to clone the input, add the constraint and to disable the old input.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!