All Apps and Add-ons

In Splunk for Salesforce, how do I re-import one of my salesforce objects

btyeung
New Member

I've included an additional field in my SOQL query and want to collect the value of this field. What's the best to force a refresh?

Cheers,
BY

0 Karma

btyeung
New Member

The date format was tripping me up I think. When I removed the date from it, it seemed to import my items just fine. Are there examples of the date formatting?

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

yes its the date format. its the same format that you see right above the "Start Date" field on the UI and the only one accepted for now is "YYYY-MM-DDThh:mm:ss.000z". Need to support more format and easier ones but this one would do the trick for you.

0 Karma

btyeung
New Member

Thanks! There is one query though that I'm not sure is returning anything, however the query works when I execute it in a browser (into salesforce workbench). Called sfdc:key_date__c. Is there a way to look at the scheduled refresh job to see if it had any error?

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

Hey Bryan,

1- Make sure the data poll frequency is fast enough to pull the latest from that object
2- Assuming the latest event is indexed in Splunk, in your search use the dedup command to give you the latest event by Unique Identifier (typically its Id but it depends on your query). Here is an example:
index=sfdc source="sfdc_object://Opportunity" | dedup Id

Hope this helps.

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

Actually please ignore my previous answer as I misunderstood the question.

If you edit the SOQL query, just disable and enable the data input again and the data should have that new field again on any NEW events. If you want to have that field on old data (previously indexed), you will need to reindex that data again. Delete the old data and re-enable the data input by assigning a Start date to a previous date where you want to start reindexing

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...