report index frequency

[akshaykaul]

I am finally able to configure and get the data indexed into splunk via the salesforce report app,
I am just willing to understand what actually triggers the report to be indexed?
CUrrently I am only able to get it to index when i disable/enable the Input on the app.
Have tried running the report in salesforce but this does not get the data / report indexed.

any insight please?

thank you

[akshaykaul]

Hi ,
Can i ask about the purge option. Does it apply to KV store only.?
If i am just indexing the report (no Kv store) ; in that case are the already indexed records purged on every interval?

[akshaykaul]

@edavison
Thank you for your reply. yes i soon realised the interval setting after posting this question. 🙂
good to know that it actually trigger a report to run on the interval and pull a fresh extract in which can yes there is no need to schedule.
I was goin to shedule the report run just before interval but i guess dont need that now.
Cheers..

[edavison · Accepted solution]

The saved report is indexed at the interval (in seconds) configured in the input. I believe the default is once every 24hrs (86,400sec). The saved report does not have to be scheduled in Salesforce as the input requests a new export at each interval. It is advised you coordinate/synchronize this to align with the time window (if applicable) configured in your stored Salesforce report.

Keep in mind, some reports can take awhile for Salesforce to generate and return the data so your interval must allow for it complete and complete indexing before executing again. Also, running too frequently may cause data overlap or other undesired impacts.

[akshaykaul]

https://splunkbase.splunk.com/app/3567/