Splunk Add-On for Salesforce delayed 1-2 hours?

[adelamora]

My org has had a problem for awhile now where our Splunk logs pulled from SF are delayed between 1-2 hours. We are using the Splunk Add-On for Salesforce and the delayed logs are coming from ApexCalloutEvent. From speaking to SF and Splunk we were given a few options which I detail below:

1. Research if SF can stream events from the logs to the Splunk HTTP event collector (push).

2. Get with our dev teams and have them take a copy of the Splunk Add-On and customize the parameters for monitoring from hourly to minutes. 

I am open to any ideas. I just have not found much on this in forums or the Splunk community. 

[Gr0und_Z3r0]

hi @adelamora 

The input configuration for Event Log objects for Salesforce accepts interval in seconds. Based on the volume of data, you can increase the frequency of data collection for the apex events.

interval

Interval

The number of seconds to wait before the Splunk platform runs the command again.

https://docs.splunk.com/Documentation/AddOns/released/Salesforce/Configureinputsv1modular