All Apps and Add-ons

Splunk App for Salesforce Eventlog limiter for query start date: What is the time format for limiting events?

bandit
Motivator

Under Settings » Data inputs » Salesforce Event Log » EventLog

Get event log data from Salesforce.com.
Query Start Date:The initial date/time to use for the first query. If nothing is specified, the query will default to starting 90 days prior the date of the first run.

I tried the following to ignore Eventlog events earlier than 2/1/16, however it still receive events prior to that date.
2016-02-01T00:00:00.000Z
and
1454284800000 (epoch time for Mon, 01 Feb 2016 00:00:00 GMT)

0 Karma

kaydub00
Explorer

Just want to point out, the correct format is only accepted with a lowercase z.

2016-02-01T00:00:00.000z

0 Karma

bandit
Motivator

This appears to be the correct format. 2016-02-01T00:00:00.000Z

The issue was that the constraint is only honored for a new input setup . Changes are ignored if you edit after the setup. Workaround was to clone the input, add the constraint and to disable the old input.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...