I noticed that the Splunk documentation on this site says that this should support multiple environments (s) - looking at the code in the python scripts though it looks like it doesn't?

[url]SailPoint[/url]https://itcanvass.com/sailpoint-training IIQ version: 8.1p3 Splunk version: 8.0.9 TA version: 2.0.5

After reviewing the Splunk Plugin code (the Python code which Splunk uses to read data from SailPoint), I noticed the following bits of information:

Splunk/etc/apps/Splunk_TA_sailpoint is the plugin directory where the plugin derives its files. Splunk/etc/apps/Splunk_TA_sailpoint/bin/input_module_sailpoint_identityiq_auditevents.py – this is the file in question that caught my attention. The way the code appears to operate is that it defines a SINGLE file for where it stores the epoch date following the logic outlined below:

1. Initially, there is a file check (audit_events_checkpoint.txt) to see if the file exist
2. If Python doesn’t find it attempts to create it
3. If it fails again, it creates the folder structure and then adds the file
4. After the first three steps, Python opens the file.
5. Python then reads the files and pull the first value in (the Unix/Epoch timestamp)
6. It then uses this as part of its query outbound.