We are trying to get Salesforce (in the cloud) logs into our Splunk installation. Has anyone else experienced this, and can you give advice on a good way to get the logs from Salesforce (an external provider) into your internal Splunk system? We have some ideas but would be interested to hear of others' experiences. ... View more

Sorry this is a long question - don't be intimidated most of it is just examples of stuff that doesn't work... I am trying to create a morning check dashboard with 20 searches. I wanted to schedule these searches for three reasons: The results will show up faster, I know the data will be from a certain time, and my users won't get the error about running too many concurrent searches. I have created the 20 saved searches, scheduled them for the appropriate time and added them to the dashboard. However, when users access the dashboard, it ALWAYS runs the saved search again. This means that the time period is all wrong and makes the dashboard not useful. I can see the previous job history for the time that the search was scheduled in the job manager and even recall the cached results by clicking through to that search from the job manager. Their expire time is well long enough to cover the time that the dashboard is accessed. Accessing the dashboard results in new jobs appearing in the job manager, in addition to the scheduled ones, confirming that it is being run again. I have tried to add a dispatch.ttl = 1p to the saved search to ensure the results are cached for long enough. An example of my saved search is this: [MS_netapp_mornchk_bnprdfls011] cron_schedule = 30 6 * * * description = Used in the MS team's netapp checks dashboards dispatch.earliest_time = -810m@m dispatch.latest_time = now dispatch.ttl = 1p displayview = flashtimeline enableSched = 1 request.ui_dispatch_view = flashtimeline search = sourcetype="syslog_forward" tag::host="netapp" host="bnprdfls011.igi.ig.local" NOT eventtype=netapp_ignore AND NOT msgsev=info I have tried to add the search to the dashboard in simple and advanced xml, same results: <row> <table> <searchName>MS_netapp_mornchk_bnprdfls011</searchName> <title>bnprdfls011.igi.ig.local</title> <fields>_time, msgsev, msgtype, msgtext</fields> <option name="drilldown">row</option> <option name="count">20</option> <option name="showPager">true</option> <option name="displayRowNumbers">false</option> </table> </row> AND <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="bnprdfls011.igi.ig.local" autoRun="True"> <param name="savedSearch">MS_netapp_mornchk_bnprdfls011</param> <param name="useHistory">"True"</param> <param name="groupLabel">bnprdfls011.igi.ig.local</param> <module name="ViewstateAdapter"> <param name="savedSearch">MS_netapp_mornchk_bnprdfls011</param> <module name="HiddenFieldPicker"> <param name="fields">_time,msgsev,msgtype,msgtext</param> <param name="strictMode">True</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="count">20</param> <param name="entityName">results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="count">20</param> <param name="drilldown">row</param> <param name="allowTransformedFieldSelect">True</param> <param name="displayRowNumbers">false</param> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> What am I doing wrong? ... View more