Perhaps this is more of a Splunk question, but hoping someone in the community has run into this.


The following required arguments are missing: compression, limit

But these are not options on the dialog.

I'm new to Splunk and need to pull some data from Salesforce. The Splunk Add-on for Salesforce has an option to "Add Salesforce Event Log".

Splunk Add-on error

All of the standard object inputs have a Limit parameter after Query Start Date, but not Salesforce Event Log.

  • 1
    did you license the SFDC (not splunk) Event Log feature? – cropredy Mar 21 '18 at 18:29
  • @cropredy I just learned that the Event Log feature doesn't propagate down to sandboxes, so therefore this seems to be the issue. I didn't mention it was a sandbox in the question since I didn't know it was relevant, but now I know it is. I have just obtained access to our production Splunk environment, and it works there. Please go ahead and answer the question, and I'll mark it as the solution. Thank you! – bullcitydave Mar 22 '18 at 20:49

The SFDC EventLog feature (part of Shield) must be licensed (although is included for Developer Edition).

If you are using an existing sandbox, make sure the sandbox licenses have been sync'd from Production org Setup | Company Information | Match Production Licenses or spin up a new sandbox from PROD.

Also note that EventLog files are always 24 hours in arrears unless you are using the Event Monitoring: Log File Deletion and Hourly Event Monitoring Data (Beta) (Spring 18)

Given the above, there should be no reason why you can't read the EventLogs from splunk

  • I've confirmed that I've got Shield working in a Developer Edition org but I still get the error about Compression and Limit arguments missing when connecting to that dev org. – bullcitydave Apr 3 '18 at 17:35
  • @bullcitydave - so you can query successfully the event monitoring objects using REST via Workbench in your DE? – cropredy Apr 3 '18 at 17:49
  • Correct. Currently have a case open with Splunk engineering team but no response yet. I can create another question for a related issue, but you probably know more than anyone (info hard to come by). Any idea why adding an standard sObject input would tell me that required argument 'query' is missing? I populate all fields just like the standard inputs the add-on gives you. (Again, glad to create another question) . Thanks for your help! – bullcitydave Apr 3 '18 at 20:56
  • I think I've told you all I know – cropredy Apr 4 '18 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.