If i go to Logs & Reports, in the sophos central console, under the General Logs heading there are 2 options, Events and Audit Logs. Based on the information that is polled from the Splunk Add-on only the Event Logs are polled, is there a way to receive the Audit Logs as well?
Ingesting machine data from Sophos Central you will have 2 kinds of logs with 2 differents customer_id (it is only same alphanumeric but rearranged). One of them gives you extended information about one of the events with the other customer_id.
Could you give us some more context for your query? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.