1

Perhaps this is more of a Splunk question, but hoping someone in the community has run into this.

Error:

The following required arguments are missing: compression, limit

But these are not options on the dialog.

I'm new to Splunk and need to pull some data from Salesforce. The Splunk Add-on for Salesforce has an option to "Add Salesforce Event Log".

Splunk Add-on error

All of the standard object inputs have a Limit parameter after Query Start Date, but not Salesforce Event Log.

Improve this question
2
  • 1
    did you license the SFDC (not splunk) Event Log feature?
    – cropredy
    Commented Mar 21, 2018 at 18:29
  • @cropredy I just learned that the Event Log feature doesn't propagate down to sandboxes, so therefore this seems to be the issue. I didn't mention it was a sandbox in the question since I didn't know it was relevant, but now I know it is. I have just obtained access to our production Splunk environment, and it works there. Please go ahead and answer the question, and I'll mark it as the solution. Thank you!
    – bullcitydave
    Commented Mar 22, 2018 at 20:49

1 Answer 1

Reset to default
3

The SFDC EventLog feature (part of Shield) must be licensed (although is included for Developer Edition).

If you are using an existing sandbox, make sure the sandbox licenses have been sync'd from Production org Setup | Company Information | Match Production Licenses or spin up a new sandbox from PROD.

Also note that EventLog files are always 24 hours in arrears unless you are using the Event Monitoring: Log File Deletion and Hourly Event Monitoring Data (Beta) (Spring 18)

Given the above, there should be no reason why you can't read the EventLogs from splunk

Improve this answer
4
  • I've confirmed that I've got Shield working in a Developer Edition org but I still get the error about Compression and Limit arguments missing when connecting to that dev org.
    – bullcitydave
    Commented Apr 3, 2018 at 17:35
  • @bullcitydave - so you can query successfully the event monitoring objects using REST via Workbench in your DE?
    – cropredy
    Commented Apr 3, 2018 at 17:49
  • Correct. Currently have a case open with Splunk engineering team but no response yet. I can create another question for a related issue, but you probably know more than anyone (info hard to come by). Any idea why adding an standard sObject input would tell me that required argument 'query' is missing? I populate all fields just like the standard inputs the add-on gives you. (Again, glad to create another question) . Thanks for your help!
    – bullcitydave
    Commented Apr 3, 2018 at 20:56
  • I think I've told you all I know
    – cropredy
    Commented Apr 4, 2018 at 0:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .