All Apps and Add-ons

Splunk App for Salesforce Eventlog limiter for query start date: What is the time format for limiting events?

Motivator

Under Settings » Data inputs » Salesforce Event Log » EventLog

Get event log data from Salesforce.com.
Query Start Date:The initial date/time to use for the first query. If nothing is specified, the query will default to starting 90 days prior the date of the first run.

I tried the following to ignore Eventlog events earlier than 2/1/16, however it still receive events prior to that date.
2016-02-01T00:00:00.000Z
and
1454284800000 (epoch time for Mon, 01 Feb 2016 00:00:00 GMT)

0 Karma

Explorer

Just want to point out, the correct format is only accepted with a lowercase z.

2016-02-01T00:00:00.000z

0 Karma

Motivator

This appears to be the correct format. 2016-02-01T00:00:00.000Z

The issue was that the constraint is only honored for a new input setup . Changes are ignored if you edit after the setup. Workaround was to clone the input, add the constraint and to disable the old input.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!