Archive

Splunk AddOn for Salesforce UserAccountId field

Engager

Hi,

We are using Splunk to query the LoginHistory object from our Salesforce org. In the login report, there are two fields : UserId and UserAccountId. May I know what values do these two fields refer to? Sometimes they have same values, sometimes they have different values.

Per following release note from Splunk AddOns, it stated "Version 2.0.0 of the Splunk Add-on for Salesforce supports multiple accounts or custom endpoints. Therefore, there is a new field in version 2.0.0 called UserAccountId."

https://docs.splunk.com/Documentation/AddOns/released/Salesforce/Releasehistory

What is this UserAccountId refer to in a LoginHistory record?

Thanks,
Aryne

Tags (1)
0 Karma

Ultra Champion

This add on now allows you to collect data from multiple salesforce accounts. i.e companyA, companyB etc

The UserAccountId indicates from which Salesforce Account the events have come from:

If my comment helps, please give it a thumbs up!
0 Karma

Engager

Hello @nickhillscpl ,

Thanks for the information. 🙂

Based on my understanding of your answer, UserAccountId should refer to the Id of an Account object record.

However, in this output that I get, both UserId and UserAccountId referred to the Id of a User object/record.

Link to image : https://ibb.co/yNhZFCW

From my research, the user indicated in UserId was the actual logged in user (it has a matching record in the Login History list).

However, I am not sure how the user in UserAccountId was associated to this record in this case. There is no matching record in the Login History which shows that this user logged in to the specific url at the specific timestamps. Based on this user's login history, he/she mainly logs in via SOAP Partner API. Can you help us understand this scenario please?

On other scenarios, the UserId and UserAccountId often shows the same values. Hence this is rather confusing for us to try to figure out what the UserAccountId field actually means.

Thanks in advanced for your help.

Regards,
Aryne

0 Karma

Engager

Can someone from Splunk Add-On Support Team please enlighten me about this? The documentation about UserAccountId field is not clear enough, it would be great if it states which exact source field in Salesforce it is mapped to.

Thanks in advance!

0 Karma

Engager

Hi there,

Gradually Salesforce is deploying the concept of "Person Accounts" in their clouds.

From a Salesforce point of view, a user is also a Person. Hence this User may hold a PersonAccount record.

The ID itself represents the unique ID from the user object, and the UserAccountId represents the corresponding PersonAccount (from the Account object), if any.

HTH,

Engager

Hi @pocfabienbnc ,

Thank you very much for the clarification. 🙂

That answered my question.

Regards,
Aryne

0 Karma