Introduction

This app relies on Splunk Add-on for Salesforce to index structured and unstructured data from your Salesforce instance over the REST API. Please install download this addon from https://splunkbase.splunk.com/app/3549/ and make sure you go through its documentation.

Data Collected by the Addon:

• The unstructured data is coming from the Salesforce Event Log File API. This API needs to be enabled on your instance and it is not enabled by default. For any questions about this API, please contact your Salesforce admin or Salesforce sales rep. for the same. For more information on the Event Log File API, please refer to the following link:
  Salesforce release notes

• The structured data is mainly used for enriching the log events via lookups. This data is collected over REST API as well by periodically running SOQL queries. The poll frequency is configurable as needed

You can watch a short demo video of the App here Splunk App for Salesforce Video

For Frequently asked question, please refer to the bottom of that page

Architecture

The following diagram represents the logical architecture of the Splunk App for Salesforce:

Deployment in Distributed Environments

• Install and configure the add-on on a Heavy-Weight Fowarder or equivalent. For configuration steps, please check the "configuration" section
• Install the Add-on on Search head
• Install the Splunk App for Saleforce on Search Head. Enable the saved searches highlighted on the configuration step

Pre-requisite

1. Enable the Salesforce Event Log File API
   The Splunk App for Salesforce relies on the Event Log File API to access the Salesfoce log data. This API is not enabled by default.
   Common use cases of this API include tracking user activity, user feature adoption, and troubleshooting issues that may arise in your Salesfoce environment, and many others.
   For more information please refer to the following Link:
   Event Log File API
   Please contact your Salesforce admin or rep. to get access to the Event Log File API.

2. Salesforce Service Account
   In order to collect the data from Salesforce, Splunk App for Salesforce requires a Salesforce user to be created with the following permission:

   1. API Enabled
   2. Read access to the following Salesforce objects: Event Log File, Report, Dashboard, User, Opportunity, Account and loginHistory
   3. If you want Splunk to write alerts to a chatter group, the user needs to have write access to the Salesforce Chatter group as well.
   4. In order to connect over the REST API, the Salesforce user needs to have the Security Token Associated with it. If you do not have the security Token, use the instrcutions on the following link:
      Reset Security Token

Validate that you have the right access

Login to Workbench by accessing the following URL: link
Select Jump to “SOQL Query”
And object set to “Account”

On the next screen make sure you have access to the following Objects (under the Object drop down list):
Account

• User
• Report
• Dashboard
• EventLogFile
• LoginHistory
• Opportunity
  

Configuration

1. After you have installed the Add-on, go through the add-on steps for configuring data collection. For more details, please refer to: http://docs.splunk.com/Documentation/AddOns/released/Salesforce/About.
2. After you have configured your Salesforce account from the "Configuration" tab of the add-on, go to the "Inputs" tab and create and configure the "Salesforce Event Log" input.
3. The add-on comes with 6 inputs of type "Salesforce Object". These inputs are: Loginhistory, opportunity, account, user, report and dahsboard. Edit each one them to select the account to be used for authentication and theenvironment type (Sandbox or Production) and paste the token.
4. Enable all 6 of the inputs that you have edited on step#3
5. Please allow the Splunk App for Salesforce some time for the data to come in. After letting the app collect the data for few hours, please run the following searches manually to build the lookup tables. This can be done by going to Settings -> Searches and running the 4 following searches one at a time:
6. Lookup - ACCOUNT_ID TO ACCOUNT_NAME - comes with the Splunk App for Salesforce
7. Lookup - OBJECT_ID to OBJECT_NAME - comes with the Splunk App for Salesforce
8. Lookup - OPPORTUNITY_ID TO OPPORTUNITY_NAME - comes with the Splunk App for Salesforce
9. Lookup - USER_ID to USER_NAME - comes with the Splunk Add-on for Salesforce

Deprecated - Feeding Data to Salesforce

This command has been removed and deprecated from App

Frequently Asked Questions

• Q1: How can I validate that I am getting data from Salesforce?
• A1: Go to the Search tab and type: index=sfdc. You should see data returned by the search
• Q2: I went through the App setup but still cant see any data from Salesforce.
• A2: type index=_internal error sfdc and see if you have any errors related to data collect
• Q3: I can see that I am getting Salesforce data in Splunk but some of the dashboards are not fully loaded
• A3: First, make sure you build the lookups in your Splunk environment by following the the steps highlighted under the "configuration" section above. Second, give the data collection few hours to make sure it gets current.