All Apps and Add-ons

Splunk App for Salesforce: Why is there no data showing in any dashboards?

JAbbottNinja
Explorer

Hi everyone, I'm sure this is a question that's been answered before, but my google-fu is failing me.  I am running Splunk Cloud 8.2 (Victoria), Salesforce App for Splunk version 4.11, and Splunk Add-on for Salesforce version 4.4.0-1651043262.  I have the Salesforce app configured and data inputs set and I have data in my index from all the sources:

JAbbottNinja_1-1659010615228.png

What I don't have, however, is literally any data populating any of my dashboards:

JAbbottNinja_0-1659010388723.png

I'm wondering if it has anything to do with the lookup tables being broken:

  • Could not load lookup=LOOKUP-SFDC-USER_NAME

I have enabled the saved search and run it, successfully (per the Add-on docs); however, the App docs have saved Lookup searches that, when I run, don't return data:

JAbbottNinja_2-1659010995578.png

So the lookups aren't populated.  Also there are only 3 lookups, not 4 like in the docs.  I'm sure I'm missing something *very* simple; but anyone have any ideas?

Labels (3)
0 Karma
1 Solution

chaker
Contributor

That index may need to be set to default searchable to be picked up by the populating search. Or edit the search to specify the index.

View solution in original post

0 Karma

JAbbottNinja
Explorer

Yes, my data is fully populated in the index, and I have run the searches; however as I indicated, they return nothing and thus do not populate the LOOKUP files

0 Karma

chaker
Contributor

That index may need to be set to default searchable to be picked up by the populating search. Or edit the search to specify the index.

0 Karma

JAbbottNinja
Explorer

Ok, so progress!  Adding the index fixed the Account_Id to Account_Name Lookup; thanks, I should have thought of that 😞 

chaker
Contributor

https://splunkbase.splunk.com/app/1931/#/details

Try that?

  • Q3: I can see that I am getting Salesforce data in Splunk but some of the dashboards are not fully loaded
  • A3: First, make sure you build the lookups in your Splunk environment by following the the steps highlighted under the "configuration" section above. Second, give the data collection few hours to make sure it gets current.
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...