Salesforce in SPLUNK

[linaaabad]

I am confused on why I only get _ID's from my Salesforce ingest, for example, I am not getting Username, Profile Name, Dashboard Name, Report Names...etc...I am getting the User ID, Profile ID, Dashboard ID, and so fourth, it makes searches really difficult...How am I to correlate the ID to readable relevant information.? Where User_ID equates to Username (Davey Jones)? Help Please. 

[Gr0und_Z3r0]

In the salesforce app for splunk, there's a lookup you can use to get the mapping of user ids and user names. Use the following apps for ingestion of Salesforce events & objects. For stream events, use the streaming app.

Splunk Add-on for Salesforce -> https://splunkbase.splunk.com/app/3549 

Splunk Add-on for Salesforce Streaming API -> https://splunkbase.splunk.com/app/5689

Splunk App for Salesforce -> https://splunkbase.splunk.com/app/1931 

[yuanliu]

There might be a Salesforce app that can manage ingestion and extraction.  Short of that, if you are certain that ingestion is complete, you can post sample events (anonymize as needed) so volunteers can help.