This App provides deep insight into three categories:
• Application Management
• Adoption and Usage Analytics
• Security
Sample dashboards that come with the app:
• Detect security threats by analyzing login patterns
• Prevent data loss by monitoring Report exports, accessed documents, previews, etc
• Perform trend analysis for all access to salesforce by user, group, regions
• Detect problems in your Salesforce reports and dashboards
• Detect problems with your Salesforce Apex custom classes, queries, triggers, APIs
• Salesforce Adoption and Usage Analytics
Check out the demo video:
https://www.youtube.com/watch?v=YRMwyqpa-3Y&feature=share&app=desktop
IMPOTANT: Please read the documentation before upgrading to 4.0.1
In order to follow best practices, this version of the 4.0.1 version of the app removes the sfdc index that ships in previous releases. If you are using this index from previous releases, and before you upgrade, make sure you have the index.conf (within default folder of the app ) backed-up outside of the app in order to avoid losing any data.
Introduction
This app relies on Splunk Add-on for Salesforce to index structured and unstructured data from your Salesforce instance over the REST API. Please install download this addon from https://splunkbase.splunk.com/app/3549/ and make sure you go through its documentation.
Data Collected by the Addon:
-
The unstructured data is coming from the Salesforce Event Log File API. This API needs to be enabled on your instance and it is not enabled by default. For any questions about this API, please contact your Salesforce admin or Salesforce sales rep. for the same. For more information on the Event Log File API, please refer to the following link:
Salesforce release notes
-
The structured data is mainly used for enriching the log events via lookups. This data is collected over REST API as well by periodically running SOQL queries. The poll frequency is configurable as needed
You can watch a short demo video of the App here Splunk App for Salesforce Video
For Frequently asked question, please refer to the bottom of that page
Architecture
The following diagram represents the logical architecture of the Splunk App for Salesforce:
Deployment in Distributed Environments
- Install and configure the add-on on a Heavy-Weight Fowarder or equivalent. For configuration steps, please check the "configuration" section
- Install the Add-on on Search head
- Install the Splunk App for Saleforce on Search Head. Enable the saved searches highlighted on the configuration step
Pre-requisite
-
Enable the Salesforce Event Log File API
The Splunk App for Salesforce relies on the Event Log File API to access the Salesfoce log data. This API is not enabled by default.
Common use cases of this API include tracking user activity, user feature adoption, and troubleshooting issues that may arise in your Salesfoce environment, and many others.
For more information please refer to the following Link:
Event Log File API
Please contact your Salesforce admin or rep. to get access to the Event Log File API.
-
Salesforce Service Account
In order to collect the data from Salesforce, Splunk App for Salesforce requires a Salesforce user to be created with the following permission:
- API Enabled
- Read access to the following Salesforce objects: Event Log File, Report, Dashboard, User, Opportunity, Account and loginHistory
- If you want Splunk to write alerts to a chatter group, the user needs to have write access to the Salesforce Chatter group as well.
- In order to connect over the REST API, the Salesforce user needs to have the Security Token Associated with it. If you do not have the security Token, use the instrcutions on the following link:
Reset Security Token
Validate that you have the right access
Login to Workbench by accessing the following URL: link
Select Jump to “SOQL Query”
And object set to “Account”
On the next screen make sure you have access to the following Objects (under the Object drop down list):
Account
- User
- Report
- Dashboard
- EventLogFile
- LoginHistory
- Opportunity
Configuration
- After you have installed the Add-on, go through the add-on steps for configuring data collection. For more details, please refer to: http://docs.splunk.com/Documentation/AddOns/released/Salesforce/About.
- After you have configured your Salesforce account from the "Configuration" tab of the add-on, go to the "Inputs" tab and create and configure the "Salesforce Event Log" input.
- The add-on comes with 6 inputs of type "Salesforce Object". These inputs are: Loginhistory, opportunity, account, user, report and dahsboard. Edit each one them to select the account to be used for authentication and theenvironment type (Sandbox or Production) and paste the token.
- Enable all 6 of the inputs that you have edited on step#3
- Please allow the Splunk App for Salesforce some time for the data to come in. After letting the app collect the data for few hours, please run the following searches manually to build the lookup tables. This can be done by going to Settings -> Searches and running the 4 following searches one at a time:
- Lookup - ACCOUNT_ID TO ACCOUNT_NAME - comes with the Splunk App for Salesforce
- Lookup - OBJECT_ID to OBJECT_NAME - comes with the Splunk App for Salesforce
- Lookup - OPPORTUNITY_ID TO OPPORTUNITY_NAME - comes with the Splunk App for Salesforce
- Lookup - USER_ID to USER_NAME - comes with the Splunk Add-on for Salesforce
Deprecated - Feeding Data to Salesforce
This command has been removed and deprecated from App
Frequently Asked Questions
- Q1: How can I validate that I am getting data from Salesforce?
- A1: Go to the Search tab and type: index=sfdc. You should see data returned by the search
- Q2: I went through the App setup but still cant see any data from Salesforce.
- A2: type index=_internal error sfdc and see if you have any errors related to data collect
- Q3: I can see that I am getting Salesforce data in Splunk but some of the dashboards are not fully loaded
- A3: First, make sure you build the lookups in your Splunk environment by following the the steps highlighted under the "configuration" section above. Second, give the data collection few hours to make sure it gets current.
