Splunk Cloud Platform

Why is there Salesforce EventLogFile error?

pedromvieira
Communicator

We can connect successfully with Salesforce TA and grab data from common objects, like Audit Trail.

However, EventLogFile type can't log anything and throw those errors.

 

2021-08-09 20:23:01,824 +0000 log_level=ERROR, pid=24066, tid=MainThread, file=engine_v2.py, func_name=start, code_line_no=57 | [stanza_name=QA_EVENTLOG] CloudConnectEngine encountered exception Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_salesforce/lib/cloudconnectlib/core/engine_v2.py", line 52, in start for temp in result: File "/opt/splunk/etc/apps/Splunk_TA_salesforce/lib/cloudconnectlib/core/job.py", line 88, in run contexts = list(self._running_task.perform(self._context) or ()) File "/opt/splunk/etc/apps/Splunk_TA_salesforce/lib/cloudconnectlib/core/task.py", line 289, in perform raise CCESplitError cloudconnectlib.core.exceptions.CCESplitError


2021-08-09 20:23:01,822 +0000 log_level=ERROR, pid=24066, tid=MainThread, file=task.py, func_name=_send_request, code_line_no=505 | [stanza_name=QA_EVENTLOG] The response status=400 for request which url=MYCOMPANY--qa.my.salesforce.com/services/data/v51.0/query?q=SELECT%20Id%2CEventType%2CLogDate%20FROM%20EventLogFile%20WHERE%20LogDate%3E%3D2020-01-01T00%3A00%3A00.000z%20AND%20Interval%3D%27Daily%27%20ORDER%20BY%20LogDate%20LIMIT%201000 and method=GET and message=[{"message":"\nLogDate>=2020-01-01T00:00:00.000z AND Interval='Daily' ORDER BY LogDate\n ^\nERROR at Row:1:Column:91\nNo such column 'Interval' on entity 'EventLogFile'. If you are attempting to use a custom field, be sure to append the '__c' after the custom field name. Please reference your WSDL or the describe call for the appropriate names.","errorCode":"INVALID_FIELD"}]

We just checked and all permissions are corrected (View Event Log Files / View All Data e API Enabled).

Labels (1)
0 Karma

lianwan
Explorer

It worked for me. The only downside is that the UI for inputs editing is broken

0 Karma

pedromvieira
Communicator

If I comment the monitor interval inside inputs.conf, it works.

In the Splunk UI is a required field.

sudo cat /opt/splunk/etc/apps/Splunk_TA_salesforce/local/inputs.conf

[sfdc_event_log://QA_EVENTLOG]
account = QA
index = mycompany_salesforce_eventlog
interval = 30
#monitoring_interval = Daily
disabled = 0
start_date = 2020-01-01T00:00:00.000z

Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...