Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- report index frequency
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am finally able to configure and get the data indexed into splunk via the salesforce report app,
I am just willing to understand what actually triggers the report to be indexed?
CUrrently I am only able to get it to index when i disable/enable the Input on the app.
Have tried running the report in salesforce but this does not get the data / report indexed.
any insight please?
thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The saved report is indexed at the interval (in seconds) configured in the input. I believe the default is once every 24hrs (86,400sec). The saved report does not have to be scheduled in Salesforce as the input requests a new export at each interval. It is advised you coordinate/synchronize this to align with the time window (if applicable) configured in your stored Salesforce report.
Keep in mind, some reports can take awhile for Salesforce to generate and return the data so your interval must allow for it complete and complete indexing before executing again. Also, running too frequently may cause data overlap or other undesired impacts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
Can i ask about the purge option. Does it apply to KV store only.?
If i am just indexing the report (no Kv store) ; in that case are the already indexed records purged on every interval?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@edavison
Thank you for your reply. yes i soon realised the interval setting after posting this question. 🙂
good to know that it actually trigger a report to run on the interval and pull a fresh extract in which can yes there is no need to schedule.
I was goin to shedule the report run just before interval but i guess dont need that now.
Cheers..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The saved report is indexed at the interval (in seconds) configured in the input. I believe the default is once every 24hrs (86,400sec). The saved report does not have to be scheduled in Salesforce as the input requests a new export at each interval. It is advised you coordinate/synchronize this to align with the time window (if applicable) configured in your stored Salesforce report.
Keep in mind, some reports can take awhile for Salesforce to generate and return the data so your interval must allow for it complete and complete indexing before executing again. Also, running too frequently may cause data overlap or other undesired impacts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
