[SailPoint] Get older events

MandarinDefense — Fri, 21 Aug 2026 14:53:13 GMT

Hello,

I enabled the app SailPoint Identity Security Cloud AuditEvent but I'd like to ingest older event.

There is no option in the configuration (I think) to set the time range on which the Splunk app gather events.

Does anyone faced the same issue ?

Bye

Re: [SailPoint] Get older events

PickleRick — Sat, 22 Aug 2026 11:01:56 GMT

The docs for the add-on - https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/SailPoint-Identity-Security-Cloud-AuditEvent-Add-on-for-Splunk/ta-p/77123#toc-hId--933693274

Say this:

NOTE: As of version 2.0.0, if the Splunk add-on loses its connection to Identity Security Cloud (manually disabled, credentials are removed, etc) for longer than a 24 hour period, it will begin collecting events from the time of reactivation/reconnection. For administrators, this means that if the add-on collection is suspended longer than 24 hours, audit events for this time period will not be available in Splunk. These events will still be retrievable via the IdentityNow API's.

I would read it as "the app reads at most 24 hours of backlog data". And it seems to be by design. You could fiddle with the add-on internals if it's in a readable form (I haven't checked if it's in python, as a binary or whatever).

topic [SailPoint] Get older events in Monitoring Splunk

[SailPoint] Get older events

Re: [SailPoint] Get older events