In the salesforce app for splunk, there's a lookup you can use to get the mapping of user ids and user names. Use the following apps for ingestion of Salesforce events & objects. For stream events, use the streaming app. Splunk Add-on for Salesforce -> https://splunkbase.splunk.com/app/3549  Splunk Add-on for Salesforce Streaming API -> https://splunkbase.splunk.com/app/5689 Splunk App for Salesforce -> https://splunkbase.splunk.com/app/1931  ... View more

Hello @linaaabad! @MuS solution should give you a good start. Please don't use "join" instead use stats .. by as  above. Refer the below for documentation. https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Writing_better_queries_in_Splunk_Search_Processing_Language https://conf.splunk.com/watch/conf-online.html?search=PLA1528B#/     ... View more

Hi @linaaabad  The Splunk App for Salesforce is a search head app containing views and dashboards shared by a Splunk community member as a starting point for other users, like yourself, to get a head start at looking at and understanding the SF event data.  Splunk would have no interest in providing a search head app for Salesforce as they are not experts in the Salesforce data.  Being limited to only using Splunk produced apps will only slow down any development in understanding the SF data. Having said that, an app is just an archive file containing configuration in flat text files - *.conf file and *.xml files for dashboards/views.  You do not have to install the app to be able to view these files, simply download the app and open the archive file using your favored utility, e.g. zip on Windows or tar on *nix and look at these types of  files under the default folder.  If you are not very experienced in Splunk then it will be a confusing place to start, however. Alternatively, if there is a test system you could install the app you could look at the configuration via the Web UI and copy what you want to your other system. Hope that helps a little bit.    ... View more