icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk App for Salesforce
SHA256 checksum (splunk-app-for-salesforce_300.tgz) a6de26f3ab8da71999a8c8cf8fb628a4b0dd0997db31e649e5b548ee9632bce8 SHA256 checksum (splunk-app-for-salesforce_262.tgz) f25caf8ecf07ec73745a13b30732fd53f74ff84fdb98c3150037dfdd5bcd0549
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Splunk App for Salesforce

Overview
Details
This App provides deep insight into three categories:
• Application Management
• Adoption and Usage Analytics
• Security

Sample dashboards that come with the app:
• Detect security threats by analyzing login patterns
• Prevent data loss by monitoring Report exports, accessed documents, previews, etc
• Perform trend analysis for all access to salesforce by user, group, regions
• Detect problems in your Salesforce reports and dashboards
• Detect problems with your Salesforce Apex custom classes, queries, triggers, APIs
• Salesforce Adoption and Usage Analytics

Check out the demo video:
https://www.youtube.com/watch?v=YRMwyqpa-3Y&feature=share&app=desktop

IMPOTANT: Please read the documentation before upgrading to 3.0.0

Introduction

This app relies on Splunk Add-on for Salesforce to index structured and unstructured data from your Salesforce instance over the REST API. Please install download this addon from https://splunkbase.splunk.com/app/3549/ and make sure you go through its documentation.

Data Collected by the Addon:

  • The unstructured data is coming from the Salesforce Event Log File API. This API needs to be enabled on your instance and it is not enabled by default. For any questions about this API, please contact your Salesforce admin or Salesforce sales rep. for the same. For more information on the Event Log File API, please refer to the following link:
    Salesforce release notes

  • The structured data is mainly used for enriching the log events via lookups. This data is collected over REST API as well by periodically running SOQL queries. The poll frequency is configurable as needed

You can watch a short demo video of the App here Splunk App for Salesforce Video

For Frequently asked question, please refer to the bottom of that page

Architecture

The following diagram represents the logical architecture of the Splunk App for Salesforce:

Architecture

Deployment in Distributed Environments

  • Install and configure the add-on on a Heavy-Weight Fowarder or equivalent. For configuration steps, please check the "configuration" section
  • Install the Add-on on Search head
  • Install the Splunk App for Saleforce on Search Head. Enable the saved searches highlighted on the configuration step

Pre-requisite

  1. Enable the Salesforce Event Log File API
    The Splunk App for Salesforce relies on the Event Log File API to access the Salesfoce log data. This API is not enabled by default.
    Common use cases of this API include tracking user activity, user feature adoption, and troubleshooting issues that may arise in your Salesfoce environment, and many others.
    For more information please refer to the following Link:
    Event Log File API
    Please contact your Salesforce admin or rep. to get access to the Event Log File API.

  2. Salesforce Service Account
    In order to collect the data from Salesforce, Splunk App for Salesforce requires a Salesforce user to be created with the following permission:

    1. API Enabled
    2. Read access to the following Salesforce objects: Event Log File, Report, Dashboard, User, Opportunity, Account and loginHistory
    3. If you want Splunk to write alerts to a chatter group, the user needs to have write access to the Salesforce Chatter group as well.
    4. In order to connect over the REST API, the Salesforce user needs to have the Security Token Associated with it. If you do not have the security Token, use the instrcutions on the following link:
      Reset Security Token

Validate that you have the right access

Login to Workbench by accessing the following URL: link
Select Jump to “SOQL Query”
And object set to “Account”
1

On the next screen make sure you have access to the following Objects (under the Object drop down list):
Account

  • User
  • Report
  • Dashboard
  • EventLogFile
  • LoginHistory
  • Opportunity
    1

Configuration

  1. After you have installed the Add-on, go through the add-on steps for configuring data collection. For more details, please refer to: http://docs.splunk.com/Documentation/AddOns/released/Salesforce/About.
  2. After you have configured your Salesforce account from the "Configuration" tab of the add-on, go to the "Inputs" tab and create and configure the "Salesforce Event Log" input.
  3. The add-on comes with 6 inputs of type "Salesforce Object". These inputs are: Loginhistory, opportunity, account, user, report and dahsboard. Edit each one them to select the account to be used for authentication and theenvironment type (Sandbox or Production) and paste the token.
  4. Enable all 6 of the inputs that you have edited on step#3
  5. Please allow the Splunk App for Salesforce some time for the data to come in. After letting the app collect the data for few hours, please run the following searches manually to build the lookup tables. This can be done by going to Settings -> Searches and running the 4 following searches one at a time:
  6. Lookup - ACCOUNT_ID TO ACCOUNT_NAME - comes with the Splunk App for Salesforce
  7. Lookup - OBJECT_ID to OBJECT_NAME - comes with the Splunk App for Salesforce
  8. Lookup - OPPORTUNITY_ID TO OPPORTUNITY_NAME - comes with the Splunk App for Salesforce
  9. Lookup - USER_ID to USER_NAME - comes with the Splunk Add-on for Salesforce

Deprecated - Feeding Data to Salesforce

This command has been removed and deprecated from App

Frequently Asked Questions

  • Q1: How can I validate that I am getting data from Salesforce?
  • A1: Go to the Search tab and type: index=sfdc. You should see data returned by the search
  • Q2: I went through the App setup but still cant see any data from Salesforce.
  • A2: type index=_internal error sfdc and see if you have any errors related to data collect
  • Q3: I can see that I am getting Salesforce data in Splunk but some of the dashboards are not fully loaded
  • A3: First, make sure you build the lookups in your Splunk environment by following the the steps highlighted under the "configuration" section above. Second, give the data collection few hours to make sure it gets current.

Release Notes

Version 3.0.0
June 9, 2017

1- App relies on Add-on for data collection. No longer has data collection
2- App is used for Visualization only
3- Deprecated the chatter feed command

Version 2.62
Oct. 20, 2016

467
Installs
3,551
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2019 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.