All Apps and Add-ons

Splunk App for Salesforce Eventlog limiter for query start date: What is the time format for limiting events?

bandit
Motivator

Under Settings » Data inputs » Salesforce Event Log » EventLog

Get event log data from Salesforce.com.
Query Start Date:The initial date/time to use for the first query. If nothing is specified, the query will default to starting 90 days prior the date of the first run.

I tried the following to ignore Eventlog events earlier than 2/1/16, however it still receive events prior to that date.
2016-02-01T00:00:00.000Z
and
1454284800000 (epoch time for Mon, 01 Feb 2016 00:00:00 GMT)

0 Karma

kaydub00
Explorer

Just want to point out, the correct format is only accepted with a lowercase z.

2016-02-01T00:00:00.000z

0 Karma

bandit
Motivator

This appears to be the correct format. 2016-02-01T00:00:00.000Z

The issue was that the constraint is only honored for a new input setup . Changes are ignored if you edit after the setup. Workaround was to clone the input, add the constraint and to disable the old input.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...