---
title: "crm.salesforce"
canonical: "https://docs.devo.com/space/latest/330989601/crm.salesforce"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `crm.salesforce` identify events generated by [Salesforce](https://www.salesforce.com/eu/).

## Valid tags and data tables 

The full tag must have at least 2 levels. The first two are fixed as** **`crm.salesforce`. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Salesforce | `crm.salesforce` | `crm.salesforce` |
| `crm.salesforce.apexcallout` | `crm.salesforce.apexcallout` |
| `crm.salesforce.apexexecution` | `crm.salesforce.apexexecution` |
| `crm.salesforce.apexrestapi` | `crm.salesforce.apexrestapi` |
| `crm.salesforce.apexsoap` | `crm.salesforce.apexsoap` |
| `crm.salesforce.apextrigger` | `crm.salesforce.apextrigger` |
| `crm.salesforce.apexunexpectedexception` | `crm.salesforce.apexunexpectedexception` |
| `crm.salesforce.api` | `crm.salesforce.api` |
| `crm.salesforce.asyncreportrun` | `crm.salesforce.asyncreportrun` |
| `crm.salesforce.audit` | `crm.salesforce.audit` |
| `crm.salesforce.bulkapi` | `crm.salesforce.bulkapi` |
| `crm.salesforce.concurrentlongrunningapexlimit` | `crm.salesforce.concurrentlongrunningapexlimit` |
| `crm.salesforce.console` | `crm.salesforce.console` |
| `crm.salesforce.contentdocumentlink` | `crm.salesforce.contentdocumentlink` |
| `crm.salesforce.contenttransfer` | `crm.salesforce.contenttransfer` |
| `crm.salesforce.documentattachmentdownloads` | `crm.salesforce.documentattachmentdownloads` |
| `crm.salesforce.knowledgearticleview` | `crm.salesforce.knowledgearticleview` |
| `crm.salesforce.lightningerror` | `crm.salesforce.lightningerror` |
| `crm.salesforce.lightninginteraction` | `crm.salesforce.lightninginteraction` |
| `crm.salesforce.lightningpageview` | `crm.salesforce.lightningpageview` |
| `crm.salesforce.lightningperformance` | `crm.salesforce.lightningperformance` |
| `crm.salesforce.login` | `crm.salesforce.login` |
| `crm.salesforce.logout` | `crm.salesforce.logout` |
| `crm.salesforce.metadataapioperation` | `crm.salesforce.metadataapioperation` |
| `crm.salesforce.multiblockreport` | `crm.salesforce.multiblockreport` |
| `crm.salesforce.packageinstall` | `crm.salesforce.packageinstall` |
| `crm.salesforce.queuedexecution` | `crm.salesforce.queuedexecution` |
| `crm.salesforce.report` | `crm.salesforce.report` |
| `crm.salesforce.reportexport` | `crm.salesforce.reportexport` |
| `crm.salesforce.restapi` | `crm.salesforce.restapi` |
| `crm.salesforce.sandbox` | `crm.salesforce.sandbox` |
| `crm.salesforce.search` | `crm.salesforce.search` |
| `crm.salesforce.searchclick` | `crm.salesforce.searchclick` |
| `crm.salesforce.sites` | `crm.salesforce.sites` |
| `crm.salesforce.timebasedworkflow` | `crm.salesforce.timebasedworkflow` |
| `crm.salesforce.uri` | `crm.salesforce.uri` |
| `crm.salesforce.visualforcerequest` | `crm.salesforce.visualforcerequest` |
| `crm.salesforce.wavechange` | `crm.salesforce.wavechange` |
| `crm.salesforce.waveinteraction` | `crm.salesforce.waveinteraction` |
| `crm.salesforce.waveperformance` | `crm.salesforce.waveperformance` |

For more information, read more [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## How is the data sent to Devo? 

Use the [Salesforce Collector](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94657195).

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce](#tag1)
> - [crm.salesforce.apexcallout](#tag2)
> - [crm.salesforce.apexexecution](#tag3)
> - [crm.salesforce.apexrestapi](#tag4)
> - [crm.salesforce.apexsoap](#tag5)
> - [crm.salesforce.apextrigger](#tag6)
> 
> ### > Macro (anchor)
> 
> crm.salesforce
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *type* | `str` |  | *vtype* |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.apexcallout
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `str` |  |  |  |
> | *cpu_time* | `str` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *type* | `str` |  |  |  |
> | *method* | `str` |  |  |  |
> | *success* | `int4` |  |  |  |
> | *time* | `int4` |  |  |  |
> | *request_size* | `int4` |  |  |  |
> | *response_size* | `int4` |  |  |  |
> | *url* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.apexexecution
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *exec_time* | `int4` |  |  |  |
> | *db_total_time* | `int4` |  |  |  |
> | *callout_time* | `int4` |  |  |  |
> | *number_soql_queries* | `int4` |  |  |  |
> | *entry_point* | `str` |  |  |  |
> | *quiddity* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.apexrestapi
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *method* | `str` |  |  |  |
> | *media_type* | `str` |  |  |  |
> | *status_code* | `int4` |  |  |  |
> | *user_agent* | `int4` |  |  |  |
> | *rows_processed* | `int4` |  |  |  |
> | *number_fields* | `int4` |  |  |  |
> | *db_blocks* | `int4` |  |  |  |
> | *db_cpu_time* | `int4` |  |  |  |
> | *request_size* | `int4` |  |  |  |
> | *response_size* | `int8` |  |  |  |
> | *entity_name* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.apexsoap
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `int8` |  |  |  |
> | *client_name* | `str` |  |  |  |
> | *class_name* | `str` |  |  |  |
> | *method_name* | `str` |  |  |  |
> | *limit_usage_percent* | `str` |  |  |  |
> | *query* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.apextrigger
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `str` |  |  |  |
> | *cpu_time* | `str` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *trigger_id* | `str` |  |  |  |
> | *trigger_name* | `str` |  |  |  |
> | *entity_name* | `str` |  |  |  |
> | *trigger_type* | `str` |  |  |  |
> | *exec_time* | `int4` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *eventType* | `str` |  |  |  |
> | *bu* | `str` |  |  |  |
> | *division* | `str` |  |  |  |
> | *app_domain* | `str` |  |  |  |
> | *agent_name* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce.apexunexpectedexception](#tag7)
> - [crm.salesforce.api](#tag8)
> - [crm.salesforce.asyncreportrun](#tag9)
> - [crm.salesforce.audit](#tag10)
> - [crm.salesforce.bulkapi](#tag11)
> - [crm.salesforce.concurrentlongrunningapexlimit](#tag12)
> 
> ### > Macro (anchor)
> 
> crm.salesforce.apexunexpectedexception
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *exception_type* | `str` |  |  |  |
> | *exception_message* | `str` |  |  |  |
> | *stack_trace* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.api
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *api_type* | `str` |  |  |  |
> | *api_version* | `str` |  |  |  |
> | *client_name* | `str` |  |  |  |
> | *method_name* | `str` |  |  |  |
> | *entity_name* | `str` |  |  |  |
> | *rows_processed* | `int4` |  |  |  |
> | *request_size* | `int4` |  |  |  |
> | *response_size* | `int4` |  |  |  |
> | *db_blocks* | `int4` |  |  |  |
> | *db_cpu_time* | `int4` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.asyncreportrun
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `int8` |  |  |  |
> | *entity_name* | `str` |  |  |  |
> | *display_type* | `str` |  |  |  |
> | *rendering_type* | `str` |  |  |  |
> | *report_id* | `str` |  |  |  |
> | *row_count* | `int4` |  |  |  |
> | *number_exception_filters* | `int4` |  |  |  |
> | *number_columns* | `int4` |  |  |  |
> | *average_row_size* | `int4` |  |  |  |
> | *sort* | `str` |  |  |  |
> | *db_blocks* | `str` |  |  |  |
> | *db_cpu_time* | `str` |  |  |  |
> | *number_buckets* | `str` |  |  |  |
> | *dashboard_id* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *report_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.audit
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *timestamp* | `str` |  |
> | *logType* | `str` |  |
> | *orgID* | `str` |  |
> | *userID* | `str` |  |
> | *sourceIP* | `str` |  |
> | *uri* | `str` |  |
> | *message* | `str` |  |
> | *rawMessage* | `str` | **✓** |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.bulkapi
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *job_id* | `str` |  |  |  |
> | *batch_id* | `str` |  |  |  |
> | *rows_processed* | `int4` |  |  |  |
> | *number_failures* | `int4` |  |  |  |
> | *success* | `int4` |  |  |  |
> | *message* | `str` |  |  |  |
> | *entity_type* | `str` |  |  |  |
> | *operation_type* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.concurrentlongrunningapexlimit 
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *number_requests* | `int4` |  |  |  |
> | *requests_limit* | `int4` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *request_uri* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce.console](#tag13)
> - [crm.salesforce.contentdocumentlink](#tag14)
> - [crm.salesforce.contenttransfer](#tag15)
> - [crm.salesforce.documentattachmentdownloads](#tag16)
> - [crm.salesforce.knowledgearticleview](#tag17)
> - [crm.salesforce.lightningerror](#tag18)
> 
> ### > Macro (anchor)
> 
> crm.salesforce.console
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *console_id* | `str` |  |  |  |
> | *component_id* | `str` |  |  |  |
> | *record_id* | `str` |  |  |  |
> | *license_context* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *console_id_derived* | `str` |  |  |  |
> | *component_id_derived* | `str` |  |  |  |
> | *record_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.contentdocumentlink
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *document_id* | `str` |  |  |  |
> | *shared_with_entity_id* | `str` |  |  |  |
> | *sharing_permission* | `str` |  |  |  |
> | *sharing_operation* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.contenttransfer
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *transaction_type* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *document_id* | `str` |  |  |  |
> | *version_id* | `str` |  |  |  |
> | *file_type* | `str` |  |  |  |
> | *file_preview_type* | `str` |  |  |  |
> | *size_bytes* | `int4` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *document_id_derived* | `str` |  |  |  |
> | *version_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.documentattachmentdownloads
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *entity_id* | `str` |  |  |  |
> | *file_type* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.knowledgearticleview
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *session_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *context* | `str` |  |  |  |
> | *entity* | `str` |  |  |  |
> | *language* | `str` |  |  |  |
> | *last_version* | `str` |  |  |  |
> | *article_status* | `str` |  |  |  |
> | *article_id* | `str` |  |  |  |
> | *article_version_id* | `str` |  |  |  |
> | *article_version* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.lightningerror
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *client_id* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *app_name* | `str` |  |  |  |
> | *device_platform* | `str` |  |  |  |
> | *sdk_app_version* | `str` |  |  |  |
> | *os_name* | `str` |  |  |  |
> | *os_version* | `str` |  |  |  |
> | *user_agent* | `str` |  |  |  |
> | *browser_name* | `str` |  |  |  |
> | *browser_version* | `str` |  |  |  |
> | *sdk_version* | `str` |  |  |  |
> | *device_model* | `str` |  |  |  |
> | *device_id* | `str` |  |  |  |
> | *sdk_app_type* | `str` |  |  |  |
> | *connection_type* | `str` |  |  |  |
> | *ui_event_id* | `str` |  |  |  |
> | *ui_event_type* | `str` |  |  |  |
> | *ui_event_source* | `str` |  |  |  |
> | *ui_event_timestamp* | `str` |  |  |  |
> | *page_start_time* | `str` |  |  |  |
> | *device_session_id* | `str` |  |  |  |
> | *ui_event_sequence_num* | `str` |  |  |  |
> | *page_entity_id* | `str` |  |  |  |
> | *page_entity_type* | `str` |  |  |  |
> | *page_context* | `str` |  |  |  |
> | *page_url* | `str` |  |  |  |
> | *page_app_name* | `str` |  |  |  |
> | *component_name* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce.lightninginteraction](#tag19)
> - [crm.salesforce.lightningpageview](#tag20)
> - [crm.salesforce.lightningperformance](#tag21)
> - [crm.salesforce.login](#tag22)
> - [crm.salesforce.logout](#tag23)
> - [crm.salesforce.metadataapioperation](#tag24)
> 
> ### > Macro (anchor)
> 
> crm.salesforce.lightninginteraction
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *client_id* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *app_name* | `str` |  |  |  |
> | *device_platform* | `str` |  |  |  |
> | *sdk_app_version* | `str` |  |  |  |
> | *os_name* | `str` |  |  |  |
> | *os_version* | `str` |  |  |  |
> | *user_agent* | `str` |  |  |  |
> | *browser_name* | `str` |  |  |  |
> | *browser_version* | `str` |  |  |  |
> | *sdk_version* | `str` |  |  |  |
> | *device_model* | `str` |  |  |  |
> | *device_id* | `str` |  |  |  |
> | *sdk_app_type* | `str` |  |  |  |
> | *connection_type* | `str` |  |  |  |
> | *ui_event_id* | `str` |  |  |  |
> | *ui_event_type* | `str` |  |  |  |
> | *ui_event_source* | `str` |  |  |  |
> | *ui_event_timestamp* | `str` |  |  |  |
> | *page_start_time* | `str` |  |  |  |
> | *duration* | `str` |  |  |  |
> | *device_session_id* | `str` |  |  |  |
> | *ui_event_sequence_num* | `str` |  |  |  |
> | *page_entity_id* | `str` |  |  |  |
> | *page_entity_type* | `str` |  |  |  |
> | *page_context* | `str` |  |  |  |
> | *page_url* | `str` |  |  |  |
> | *page_app_name* | `str` |  |  |  |
> | *target_ui_element* | `str` |  |  |  |
> | *parent_ui_element* | `str` |  |  |  |
> | *grandparent_ui_element* | `str` |  |  |  |
> | *component_name* | `str` |  |  |  |
> | *record_type* | `str` |  |  |  |
> | *record_id* | `str` |  |  |  |
> | *related_list* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.lightningpageview
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *client_id* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *app_name* | `str` |  |  |  |
> | *device_platform* | `str` |  |  |  |
> | *sdk_app_version* | `str` |  |  |  |
> | *os_name* | `str` |  |  |  |
> | *os_version* | `str` |  |  |  |
> | *user_agent* | `str` |  |  |  |
> | *browser_name* | `str` |  |  |  |
> | *browser_version* | `str` |  |  |  |
> | *sdk_version* | `str` |  |  |  |
> | *device_model* | `str` |  |  |  |
> | *device_id* | `str` |  |  |  |
> | *sdk_app_type* | `str` |  |  |  |
> | *connection_type* | `str` |  |  |  |
> | *ui_event_id* | `str` |  |  |  |
> | *ui_event_source* | `str` |  |  |  |
> | *ui_event_timestamp* | `str` |  |  |  |
> | *page_start_time* | `str` |  |  |  |
> | *duration* | `str` |  |  |  |
> | *effective_page_time* | `str` |  |  |  |
> | *device_session_id* | `str` |  |  |  |
> | *ui_event_sequence_num* | `str` |  |  |  |
> | *page_entity_id* | `str` |  |  |  |
> | *page_entity_type* | `str` |  |  |  |
> | *page_context* | `str` |  |  |  |
> | *page_url* | `str` |  |  |  |
> | *page_app_name* | `str` |  |  |  |
> | *prevpage_entity_id* | `str` |  |  |  |
> | *prevpage_entity_type* | `str` |  |  |  |
> | *prevpage_context* | `str` |  |  |  |
> | *prevpage_url* | `str` |  |  |  |
> | *prevpage_app_name* | `str` |  |  |  |
> | *target_ui_element* | `str` |  |  |  |
> | *parent_ui_element* | `str` |  |  |  |
> | *grandparent_ui_element* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.lightningperformance
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *client_id* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *app_name* | `str` |  |  |  |
> | *device_platform* | `str` |  |  |  |
> | *sdk_app_version* | `str` |  |  |  |
> | *os_name* | `str` |  |  |  |
> | *os_version* | `str` |  |  |  |
> | *user_agent* | `str` |  |  |  |
> | *browser_name* | `str` |  |  |  |
> | *browser_version* | `str` |  |  |  |
> | *sdk_version* | `str` |  |  |  |
> | *device_model* | `str` |  |  |  |
> | *device_id* | `str` |  |  |  |
> | *sdk_app_type* | `str` |  |  |  |
> | *connection_type* | `str` |  |  |  |
> | *ui_event_id* | `str` |  |  |  |
> | *ui_event_type* | `str` |  |  |  |
> | *ui_event_source* | `str` |  |  |  |
> | *ui_event_timestamp* | `str` |  |  |  |
> | *page_start_time* | `str` |  |  |  |
> | *duration* | `str` |  |  |  |
> | *device_session_id* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.login
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *browser_type* | `str` |  |  |  |
> | *api_type* | `str` |  |  |  |
> | *api_version* | `str` |  |  |  |
> | *user_name* | `str` |  |  |  |
> | *tls_protocol* | `str` |  |  |  |
> | *cipher_suite* | `str` |  |  |  |
> | *authentication_method_reference* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *login_status* | `str` |  |  |  |
> | *source_ip* | `ip4` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.logout
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *user_type* | `str` |  |  |  |
> | *session_type* | `str` |  |  |  |
> | *session_level* | `int4` |  |  |  |
> | *browser_type* | `str` |  |  |  |
> | *platform_type* | `str` |  |  |  |
> | *resolution_type* | `str` |  |  |  |
> | *app_type* | `str` |  |  |  |
> | *client_version* | `str` |  |  |  |
> | *api_type* | `str` |  |  |  |
> | *api_version* | `str` |  |  |  |
> | *user_initiated_logout* | `int4` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.metadataapioperation
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *client_id* | `str` |  |  |  |
> | *operation* | `str` |  |  |  |
> | *api_version* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce.multiblockreport](#tag25)
> - [crm.salesforce.packageinstall](#tag26)
> - [crm.salesforce.queuedexecution](#tag27)
> - [crm.salesforce.report](#tag28)
> - [crm.salesforce.reportexport](#tag29)
> - [crm.salesforce.restapi](#tag30)
> 
> ### > Macro (anchor)
> 
> crm.salesforce.multiblockreport
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *master_report_id* | `str` |  |  |  |
> | *has_chart* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.packageinstall
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *operation_type* | `str` |  |  |  |
> | *is_successful* | `str` |  |  |  |
> | *is_push* | `str` |  |  |  |
> | *is_managed* | `str` |  |  |  |
> | *is_released* | `str` |  |  |  |
> | *package_name* | `str` |  |  |  |
> | *failure_type* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.queuedexecution
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `int8` |  |  |  |
> | *job_id* | `str` |  |  |  |
> | *entry_point* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.report
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `str` |  |  |  |
> | *cpu_time* | `str` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *process* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *entity_name* | `str` |  |  |  |
> | *display_type* | `str` |  |  |  |
> | *rendering_type* | `str` |  |  |  |
> | *report_id* | `str` |  |  |  |
> | *row_count* | `int4` |  |  |  |
> | *number_exception_filters* | `int4` |  |  |  |
> | *number_columns* | `int4` |  |  |  |
> | *average_row_size* | `int4` |  |  |  |
> | *sort* | `str` |  |  |  |
> | *db_blocks* | `int4` |  |  |  |
> | *db_cpu_time* | `int4` |  |  |  |
> | *number_buckets* | `int4` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *report_id_derived* | `str` |  |  |  |
> | *action* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.reportexport
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `str` |  |  |  |
> | *cpu_time* | `str` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *client_info* | `str` |  |  |  |
> | *report_description* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.restapi
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *method* | `str` |  |  |  |
> | *media_type* | `str` |  |  |  |
> | *status_code* | `int4` |  |  |  |
> | *user_agent* | `int4` |  |  |  |
> | *rows_processed* | `int4` |  |  |  |
> | *number_fields* | `int4` |  |  |  |
> | *db_blocks* | `int4` |  |  |  |
> | *db_cpu_time* | `int4` |  |  |  |
> | *request_size* | `int4` |  |  |  |
> | *response_size* | `int8` |  |  |  |
> | *entity_name* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce.sandbox](#tag31)
> - [crm.salesforce.search](#tag32)
> - [crm.salesforce.searchclick](#tag33)
> - [crm.salesforce.sites](#tag34)
> - [crm.salesforce.timebasedworkflow](#tag35)
> - [crm.salesforce.uri](#tag36)
> 
> ### > Macro (anchor)
> 
> crm.salesforce.sandbox
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *sandbox_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *pending_sandbox_org_id* | `str` |  |  |  |
> | *current_sandbox_org_id* | `str` |  |  |  |
> | *status* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.search
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *query_id* | `str` |  |  |  |
> | *num_results* | `int4` |  |  |  |
> | *search_query* | `str` |  |  |  |
> | *prefixes_searched* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.searchclick
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *query_id* | `str` |  |  |  |
> | *clicked_record_id* | `str` |  |  |  |
> | *rank* | `int4` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.sites
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `str` |  |  |  |
> | *page_name* | `str` |  |  |  |
> | *request_type* | `str` |  |  |  |
> | *is_first_request* | `str` |  |  |  |
> | *query* | `str` |  |  |  |
> | *site_id* | `str` |  |  |  |
> | *is_secure* | `str` |  |  |  |
> | *is_guest* | `str` |  |  |  |
> | *is_api* | `str` |  |  |  |
> | *is_error* | `str` |  |  |  |
> | *http_method* | `str` |  |  |  |
> | *http_headers* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.timebasedworkflow
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *type* | `str` |  |  |  |
> | *data* | `str` |  |  |  |
> | *number_of_records* | `int4` |  |  |  |
> | *log_group_id* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.uri
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `int8` |  |  |  |
> | *db_blocks* | `int4` |  |  |  |
> | *db_cpu_time* | `int4` |  |  |  |
> | *referrer_uri* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [crm.salesforce.visualforcerequest](#tag37)
> - [crm.salesforce.wavechange](#tag38)
> - [crm.salesforce.waveinteraction](#tag39)
> - [crm.salesforce.waveperformance](#tag40)
> 
> ### > Macro (anchor)
> 
> crm.salesforce.visualforcerequest
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *request_status* | `str` |  |  |  |
> | *db_total_time* | `int8` |  |  |  |
> | *page_name* | `str` |  |  |  |
> | *request_type* | `str` |  |  |  |
> | *is_first_request* | `int4` |  |  |  |
> | *query* | `str` |  |  |  |
> | *http_method* | `str` |  |  |  |
> | *user_agent* | `str` |  |  |  |
> | *request_size* | `int8` |  |  |  |
> | *response_size* | `int8` |  |  |  |
> | *view_state_size* | `str` |  |  |  |
> | *controller_type* | `str` |  |  |  |
> | *managed_package_namespace* | `str` |  |  |  |
> | *is_ajax_request* | `int4` |  |  |  |
> | *db_blocks* | `int4` |  |  |  |
> | *db_cpu_time* | `int4` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.wavechange
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *wave_session_id* | `str` |  |  |  |
> | *wave_timestamp* | `int8` |  |  |  |
> | *type* | `str` |  |  |  |
> | *record_id* | `str` |  |  |  |
> | *tab_id* | `str` |  |  |  |
> | *is_new* | `str` |  |  |  |
> | *reopen_count* | `int8` |  |  |  |
> | *analytics_mode* | `str` |  |  |  |
> | *page_context* | `str` |  |  |  |
> | *is_mobile* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.waveinteraction
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *wave_session_id* | `str` |  |  |  |
> | *wave_timestamp* | `int8` |  |  |  |
> | *type* | `str` |  |  |  |
> | *record_id* | `str` |  |  |  |
> | *tab_id* | `str` |  |  |  |
> | *total_time* | `int8` |  |  |  |
> | *read_time* | `int8` |  |  |  |
> | *num_sessions* | `int8` |  |  |  |
> | *num_clicks* | `int8` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> crm.salesforce.waveperformance
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *timestamp* | `timestamp` | ```
> parsedate(my_timestamp, "YYYYMMDDHHmmss.SSS", "UTC")
> ``` | *my_timestamp* |  |
> | *request_id* | `str` |  |  |  |
> | *organization_id* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *run_time* | `int4` |  |  |  |
> | *cpu_time* | `int4` |  |  |  |
> | *uri* | `str` |  |  |  |
> | *session_key* | `str` |  |  |  |
> | *login_key* | `str` |  |  |  |
> | *wave_session_id* | `str` |  |  |  |
> | *wave_timestamp* | `int8` |  |  |  |
> | *type* | `str` |  |  |  |
> | *record_id* | `str` |  |  |  |
> | *tab_id* | `str` |  |  |  |
> | *name* | `str` |  |  |  |
> | *ept* | `int8` |  |  |  |
> | *query_id* | `str` |  |  |  |
> | *timestamp_derived* | `timestamp` |  |  |  |
> | *user_id_derived* | `str` |  |  |  |
> | *client_ip* | `ip4` |  |  |  |
> | *uri_id_derived* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |