9 months ago
How to set up Splunk with multiple IIQ SailPoint environments with Splunk
Observing the code in the Python scripts, it appears that Splunk does not support multiple environments (s), despite what the Splunk documentation on this website claims.
Version of SailPoint IIQ: 8.1p3 Version of Splunk: 8.0.9; Version of TA: 2.0.5
Upon examining the Python code known as the Splunk Plugin, which allows Splunk to read data from SailPoint, I discovered the following details:
The plugin directory is Splunk/etc/apps/Splunk_TA_sailpoint, from which the plugin gets its files. The file that drew my attention was Splunk/etc/apps/Splunk_TA_sailpoint/bin/input_module_sailpoint_identityiq_auditevents.py.