What is the proper way to enable SeeAllData when working with Event Monitoring Big Objects?

Question

I'm using Event Monitoring & would like to use @SeAllData = true in my unit tests, so that I can leverage pre-existing logs.

However, when I enable it & query an Event Monitoring object, I end up getting a System.UnexpectedException.

Here is my unit test.

@isTest
public class Test_Logic {

@isTest (SeeAllData=true) static void TestLoginQuery(){
    DateTime StartDate = DateTime.now().addhours(-10000);
    DateTime EndDate = DateTime.now();

    List<SObject> sobjs = new List<SObject>();
    sobjs.addAll([SELECT EventIdentifier, EventDate, SourceIp, Browser, Platform, LoginUrl, HttpMethod, TlsProtocol, Status, PolicyOutcome 
                  FROM LoginEvent 
                  WHERE EventDate > :StartDate AND EventDate < :EndDate]);
   }
}

When I run it, I get the following error:

FATAL_ERROR System.UnexpectedException: common.exception.SfdcSqlException: We encountered an unexpected error. Contact Salesforce Customer Support. Error ID: 2095101290-105728 (-999027016)

Answer 1

LoginEvent is a big object that stores the event data of LoginEventStream. Accessing this object requires either the Salesforce Shield or Salesforce Event Monitoring add-on subscription and the View Data Leakage Detection Events user permission. Make sure you have those.

To query a big object you can use a subset of standard SOQL commands. You can use < and >, but only on the last field of your query. Any prior fields in your query can only use the = operator. In your example you are using two comparison operators.

As per the documentation example, try to use just one criteria in your query clause.

---

LoginEvent allows filtering over two ordered fields: EventDate and EventIdentifier. There’s a catch here; your query doesn’t work unless you use the correct order and combination of these fields. The following list provides some examples of valid and invalid queries:

You can filter solely on EventDate, but single filters on other fields fail. You can also use a comparison operator in this query type.

SELECT Application, Browser, EventDate, EventIdentifier, LoginUrl, UserId
FROM LoginEvent
WHERE EventDate <= 2014-11-27T14:54:16.000Z

https://developer.salesforce.com/docs/atlas.en-us.222.0.platform_events.meta/platform_events/sforce_api_objects_loginevent.htm

---

If you want to test some code that uses the LoginEvent object you can also try to use the JSON deserialization technique in your test code.