icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk App for Salesforce
SHA256 checksum (splunk-app-for-salesforce_413.tgz) 52b886e58c116e668c81535604e6d30f2f2fdac97e8b6eb1f05e150cd2a190b4 SHA256 checksum (splunk-app-for-salesforce_300.tgz) 8cb60be6aeb795fa6d2c68f38eaa6af96b36792549b67adcdf6b9008fb4e7409
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Splunk App for Salesforce

Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
This App provides deep insight into three categories:
• Application Management
• Adoption and Usage Analytics
• Security

Sample dashboards that come with the app:
• Detect security threats by analyzing login patterns
• Prevent data loss by monitoring Report exports, accessed documents, previews, etc
• Perform trend analysis for all access to salesforce by user, group, regions
• Detect problems in your Salesforce reports and dashboards
• Detect problems with your Salesforce Apex custom classes, queries, triggers, APIs
• Salesforce Adoption and Usage Analytics

Check out the demo video:

IMPOTANT: Please read the documentation before upgrading to 4.0.1
In order to follow best practices, this version of the 4.0.1 version of the app removes the sfdc index that ships in previous releases. If you are using this index from previous releases, and before you upgrade, make sure you have the index.conf (within default folder of the app ) backed-up outside of the app in order to avoid losing any data.


This app relies on Splunk Add-on for Salesforce to index structured and unstructured data from your Salesforce instance over the REST API. Please install download this addon from https://splunkbase.splunk.com/app/3549/ and make sure you go through its documentation.

Data Collected by the Addon:

  • The unstructured data is coming from the Salesforce Event Log File API. This API needs to be enabled on your instance and it is not enabled by default. For any questions about this API, please contact your Salesforce admin or Salesforce sales rep. for the same. For more information on the Event Log File API, please refer to the following link:
    Salesforce release notes

  • The structured data is mainly used for enriching the log events via lookups. This data is collected over REST API as well by periodically running SOQL queries. The poll frequency is configurable as needed

You can watch a short demo video of the App here Splunk App for Salesforce Video

For Frequently asked question, please refer to the bottom of that page


The following diagram represents the logical architecture of the Splunk App for Salesforce:


Deployment in Distributed Environments

  • Install and configure the add-on on a Heavy-Weight Fowarder or equivalent. For configuration steps, please check the "configuration" section
  • Install the Add-on on Search head
  • Install the Splunk App for Saleforce on Search Head. Enable the saved searches highlighted on the configuration step


  1. Enable the Salesforce Event Log File API
    The Splunk App for Salesforce relies on the Event Log File API to access the Salesfoce log data. This API is not enabled by default.
    Common use cases of this API include tracking user activity, user feature adoption, and troubleshooting issues that may arise in your Salesfoce environment, and many others.
    For more information please refer to the following Link:
    Event Log File API
    Please contact your Salesforce admin or rep. to get access to the Event Log File API.

  2. Salesforce Service Account
    In order to collect the data from Salesforce, Splunk App for Salesforce requires a Salesforce user to be created with the following permission:

    1. API Enabled
    2. Read access to the following Salesforce objects: Event Log File, Report, Dashboard, User, Opportunity, Account and loginHistory
    3. If you want Splunk to write alerts to a chatter group, the user needs to have write access to the Salesforce Chatter group as well.
    4. In order to connect over the REST API, the Salesforce user needs to have the Security Token Associated with it. If you do not have the security Token, use the instrcutions on the following link:
      Reset Security Token

Validate that you have the right access

Login to Workbench by accessing the following URL: link
Select Jump to “SOQL Query”
And object set to “Account”

On the next screen make sure you have access to the following Objects (under the Object drop down list):

  • User
  • Report
  • Dashboard
  • EventLogFile
  • LoginHistory
  • Opportunity


  1. After you have installed the Add-on, go through the add-on steps for configuring data collection. For more details, please refer to: http://docs.splunk.com/Documentation/AddOns/released/Salesforce/About.
  2. After you have configured your Salesforce account from the "Configuration" tab of the add-on, go to the "Inputs" tab and create and configure the "Salesforce Event Log" input.
  3. The add-on comes with 6 inputs of type "Salesforce Object". These inputs are: Loginhistory, opportunity, account, user, report and dahsboard. Edit each one them to select the account to be used for authentication and theenvironment type (Sandbox or Production) and paste the token.
  4. Enable all 6 of the inputs that you have edited on step#3
  5. Please allow the Splunk App for Salesforce some time for the data to come in. After letting the app collect the data for few hours, please run the following searches manually to build the lookup tables. This can be done by going to Settings -> Searches and running the 4 following searches one at a time:
  6. Lookup - ACCOUNT_ID TO ACCOUNT_NAME - comes with the Splunk App for Salesforce
  7. Lookup - OBJECT_ID to OBJECT_NAME - comes with the Splunk App for Salesforce
  8. Lookup - OPPORTUNITY_ID TO OPPORTUNITY_NAME - comes with the Splunk App for Salesforce
  9. Lookup - USER_ID to USER_NAME - comes with the Splunk Add-on for Salesforce

Deprecated - Feeding Data to Salesforce

This command has been removed and deprecated from App

Frequently Asked Questions

  • Q1: How can I validate that I am getting data from Salesforce?
  • A1: Go to the Search tab and type: index=sfdc. You should see data returned by the search
  • Q2: I went through the App setup but still cant see any data from Salesforce.
  • A2: type index=_internal error sfdc and see if you have any errors related to data collect
  • Q3: I can see that I am getting Salesforce data in Splunk but some of the dashboards are not fully loaded
  • A3: First, make sure you build the lookups in your Splunk environment by following the the steps highlighted under the "configuration" section above. Second, give the data collection few hours to make sure it gets current.

Release Notes

Version 4.1.3
Dec. 7, 2022

Fixed lookup issue colliding with salesforce addon

Version 3.0.0
June 9, 2017

1- App relies on Add-on for data collection. No longer has data collection
2- App is used for Visualization only
3- Deprecated the chatter feed command

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.