Splunk® Supported Add-ons

Splunk Add-on for Salesforce

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Set up the Splunk Add-on for Salesforce

The Splunk Add-on for Salesforce provides two ways for authenticating accounts: basic authentication, and OAuth 2.0 authentication.

For basic authentication, you can configure the Splunk Add-on for Salesforce either through Splunk Web or by making changes directly in configuration files. Due to the complexity of the setup, configuring the add-on through Splunk Web is a best practice. For OAuth, you must configure the add-on through Splunk Web.

Set up basic authentication using Splunk Web

To set up the Splunk Add-on for Salesforce using Splunk Web, complete the following steps:

  1. Go to the Splunk Add-on for Salesforce either by clicking the name of this add-on on the left navigation banner on the Splunk Web home page or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Salesforce.
  2. Click the Configuration tab to set up Salesforce credentials, as well as an optional proxy and logging level.
  3. Go to the Account tab.
  4. Click Add.
  5. Add a unique Account Name.
  6. Select a Salesforce environment value: Production, Sandbox, or Other. Other is for adding a custom endpoint that is different than the default endpoint. Here is an example: my-dev-ed.my.salesforce.com.
  7. Select the Salesforce API Version to configure your account with. Default API Version is 48.0.
  8. Select Basic Authentication for the Auth Type.
  9. Enter your Salesforce Username, Password, and Security Token. You do not need to add a token if your instance is in the trusted IP range.

Set up OAuth authentication using Splunk Web

  1. Go to the Splunk Add-on for Salesforce either by clicking the name of this add-on on the left navigation banner on the Splunk Web home page or by going to Manage Apps, then clicking Launch App in the row for the Splunk Add-on for Salesforce.
  2. Click the Configuration tab to set up Salesforce credentials, as well as an optional proxy and logging level.
  3. Go to the Account tab.
  4. Click Add.
  5. Add a unique Account Name.
  6. Select a Salesforce environment value: Production, Sandbox, or Other. Other is for adding a custom endpoint that is different than the default endpoint. Here is an example: my-dev-ed.my.salesforce.com.
  7. Select the Salesforce API Version to configure your account with. Default API Version is 48.0.
  8. Select OAuth 2.0 Authentication as the Auth Type.
  9. Enter your Salesforce Client Id and Client Secret. The Client ID is called "Consumer Key" in your Salesforce managed app. Client Secret is called "Consumer Secret" in your Salesforce managed app.
  10. Copy and paste the Redirect URL you see on the screen in your Salesforce instance. After pasting it, it can take about 10 minutes for the changes to take effect.
  11. Click Add.
  12. A popup opens for authorization consent from your Salesforce instance. Enter your authorization credentials.
  13. Click Grant access.

Set up a proxy and logging level

If you are using a proxy, provide the following information on the Configuration tab:

  1. Check Enable Proxy.
  2. Specify the Host, Port, Username, and Password values.
  3. Check the DNS resolution box if you want to perform DNS resolution through your proxy.
  4. Select the type of proxy to use in the Proxy Type field.
  5. If you want to change the Logging level, select a new one.
  6. Click Save.

Checkpoint management

If the Splunk Add-on for Splunkbase versions 2.0.0 and above find an existing checkpoint for a given input, a Use existing data input prompt appears. If you select Yes, then the add-on continues collecting data from that checkpoint. If you select No, then the add-on resets data collection, and data collection commences from your specified query start date. If you select No and there is not a specified start date, data collection commences from the default start date.

Set up basic authentication using configuration files

You can configure your add-on by providing the settings in the local splunk_ta_salesforce_settings.conf and splunk_ta_salesforce_account.conf file.

  • splunk_ta_salesforce_settings.conf includes the proxy settings, logging level settings of the Splunk add-on for Salesforce.
  • splunk_ta_salesforce_account.conf includes Salesforce account settings of the Splunk add-on for Salesforce.

To configure the Splunk Add-on for Salesforce using configuration files, complete the following steps:

  1. Create a file named splunk_ta_salesforce_settings.conf in the local folder of the add-on $SPLUNK_HOME/etc/apps/Splunk_TA_salesforce/local .
  2. Copy the following stanzas and provide the necessary values in the local splunk_ta_salesforce_settings.conf file:
    [proxy]
    proxy_enabled =  [0|1]
    proxy_type = [http|socks4|socks5]
    proxy_url = <string>
    proxy_port = <integer>
    proxy_username = <string>
    proxy_password = <string>
    proxy_rdns = [0|1]
    
    [logging]
    loglevel = [DEBUG|INFO|WARNING|ERROR|CRITICAL] 
    
  3. Create a file named splunk_ta_salesforce_account.conf in the local folder of the add-on $SPLUNK_HOME/etc/apps/Splunk_TA_salesforce/local .
  4. '
  5. Copy the following stanza and provide the necessary values in the local splunk_ta_salesforce_account.conf file:
    [account_name] // The account name you create in this add-on
    endpoint = <string> // URL of the Salesforce endpoint
    auth_type = basic
    username = <string> // The Salesforce username you want to use
    password = <string> // The password of the Salesforce username
    token = <string> // (Optional) The security token is needed if your Splunk instance is 
    outside the Salesforce trusted IP range
    
  6. After updating the local splunk_ta_salesforce_settings.conf, restart the Splunk platform for the changes to take effect. The username and password are encrypted after you configure the Salesforce input for the first time.
Last modified on 13 October, 2020
PREVIOUS
Configure your Salesforce account to collect data
  NEXT
Configure Salesforce object inputs for Splunk add-on for Salesforce

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters