Why is there Salesforce EventLogFile error?

[pedromvieira]

We can connect successfully with Salesforce TA and grab data from common objects, like Audit Trail.

However, EventLogFile type can't log anything and throw those errors.

2021-08-09 20:23:01,824 +0000 log_level=ERROR, pid=24066, tid=MainThread, file=engine_v2.py, func_name=start, code_line_no=57 | [stanza_name=QA_EVENTLOG] CloudConnectEngine encountered exception Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_salesforce/lib/cloudconnectlib/core/engine_v2.py", line 52, in start for temp in result: File "/opt/splunk/etc/apps/Splunk_TA_salesforce/lib/cloudconnectlib/core/job.py", line 88, in run contexts = list(self._running_task.perform(self._context) or ()) File "/opt/splunk/etc/apps/Splunk_TA_salesforce/lib/cloudconnectlib/core/task.py", line 289, in perform raise CCESplitError cloudconnectlib.core.exceptions.CCESplitError


2021-08-09 20:23:01,822 +0000 log_level=ERROR, pid=24066, tid=MainThread, file=task.py, func_name=_send_request, code_line_no=505 | [stanza_name=QA_EVENTLOG] The response status=400 for request which url=MYCOMPANY--qa.my.salesforce.com/services/data/v51.0/query?q=SELECT%20Id%2CEventType%2CLogDate%20FROM%20EventLogFile%20WHERE%20LogDate%3E%3D2020-01-01T00%3A00%3A00.000z%20AND%20Interval%3D%27Daily%27%20ORDER%20BY%20LogDate%20LIMIT%201000 and method=GET and message=[{"message":"\nLogDate>=2020-01-01T00:00:00.000z AND Interval='Daily' ORDER BY LogDate\n ^\nERROR at Row:1:Column:91\nNo such column 'Interval' on entity 'EventLogFile'. If you are attempting to use a custom field, be sure to append the '__c' after the custom field name. Please reference your WSDL or the describe call for the appropriate names.","errorCode":"INVALID_FIELD"}]

We just checked and all permissions are corrected (View Event Log Files / View All Data e API Enabled).

[lianwan]

It worked for me. The only downside is that the UI for inputs editing is broken

[pedromvieira]

If I comment the monitor interval inside inputs.conf, it works.

In the Splunk UI is a required field.

sudo cat /opt/splunk/etc/apps/Splunk_TA_salesforce/local/inputs.conf

[sfdc_event_log://QA_EVENTLOG]
account = QA
index = mycompany_salesforce_eventlog
interval = 30
#monitoring_interval = Daily
disabled = 0
start_date = 2020-01-01T00:00:00.000z