We have our Splunk instance connected to an API user per the specs of the Splunk App for Salesforce.
One of the things we are trying to get more insight into is the event log so we can create alerts, dashboards, etc. in order to be proactive.
From what I can tell, even though we set up the Splunk
sfdc:logfile to be on an interval of 300 seconds, I never end up getting data in Splunk until after 24 hours. This means I can't search for anything that happened unless it was 24 hours ago.
Looking at some Salesforce documentation, it appears that there is hourly log files, as well as the 24 hour.
Has anyone had experience with this Splunk app and pulling the log files in, in somewhat of a near-real-time fashion? I could live with the 1-hour delay, but the 24 just renders a lot of the Splunk functionality useless and could end up pulling the logs manually from the org.