All Apps and Add-ons

Splunk App for Salesforce Eventlog limiter for query start date: What is the time format for limiting events?


Under Settings » Data inputs » Salesforce Event Log » EventLog

Get event log data from
Query Start Date:The initial date/time to use for the first query. If nothing is specified, the query will default to starting 90 days prior the date of the first run.

I tried the following to ignore Eventlog events earlier than 2/1/16, however it still receive events prior to that date.
1454284800000 (epoch time for Mon, 01 Feb 2016 00:00:00 GMT)

0 Karma


Just want to point out, the correct format is only accepted with a lowercase z.


0 Karma


This appears to be the correct format. 2016-02-01T00:00:00.000Z

The issue was that the constraint is only honored for a new input setup . Changes are ignored if you edit after the setup. Workaround was to clone the input, add the constraint and to disable the old input.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!