About rahulbh

rahulbh · ‎11-27-2017

Hi DalJeanis, Thanks for your email. When I run the queries you mentioned then I do not get any records. I am trying to run below query - Here URI is basically who have accessed a particular object. But I get a duplicate record for a User who don't even have access to that object. I am not sure what is wrong with my query. source="sfdc_event_log://EventLog" URI = /a2m USER_ID="MentionUserId"| top limit=10 Name Name↕ count↕ percent↕ Va*** Ba**** 83 100.000000 Lu** Li** 83 100.000000

rahulbh · ‎11-23-2017

I found that the ‘SavedSearches.conf’ file is using 15 digit id and splunk search being case insensitive so it links multiple users to same eventlog. search=index=* eventtype=sfdc_user IsActive=true | sort 0 - _time | dedup Id | rename Id as UserId | fields + UserId,FirstName,City,Country,IsActive,LastLoginDate,LastName,MobilePhone,Name,PostalCode,State,Username,UserRoleId,UserType,Email,CompanyName,ProfileId,Profile.PermissionsApiEnabled,Profile.PermissionsModifyAllData,Profile.PermissionsViewSetup | fields - _* | eval USER_ID=substr(UserId, 1, len(UserId)-3) | outputlookup lookup_sfdc_usernames.csv I want to know why Salesforce App in splunk uses 15 digit id. If we use 18 digit id then it will solve the issue.

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-23-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Events link to multiple users

Re: Events link to multiple users

Events link to multiple users