What do you put down for entity format?

[ssattler]

Not getting a successful connection to the api server, documentation is not complete

[ssattler]

Caused by NewConnectionError(': Failed to establish a new connection: [Errno -2] Name or service not known

[SailPoint_IDPlu]

Good afternoon - entity format should not be a field that is required to configure the collection of AuditEvents. Complete configuration documentation is available to IdentityNow customers and partners on Compass.

[ssattler]

yes, we are a customer, we found only documents, that refer to other documents that go nowhere. some say to create a Personal Access Token

which client id and secrets are you referring to in the splunk addon? in the sailpoint admin section there are many options to configure client id and secrets.

The splunk document has no specifics, what is the "Please enter your organization/tenant name" your are asking for, looks like the format is https://url, which client ids are you requesting?

[SailPoint_IDPlu]

Yes, the integration requires that you generate a Personal Access Token using the process outlined in the links provided by the Compass documentation. The documentation also described which values from the PAT map to which values in the add-on configuration.

Your org/tenant name can be found by looking at the URL "https://org.identitynow.com" - the value 'org' is your org name.

As you are a current customer, I would suggest opening a support ticket directly with our support team so that we can better assist you in getting the integration configured.

[ssattler]

Yes, we have opened a ticket with Sailpoint. I would suggest clarifying that information in the app docs.

We have generating that pat key, and followed sailpoints guidance. We are waiting on next steps.

Thanks

[ssattler]

so, after trying a number of configurations, using the pat key AND restarting splunk made it work. Thanks