I've installed the Sophos Central API TA and configured with appropriate fields. I have even tested this with their python script and I was able to return results. However, if I search the Sophos index or view it in Data Summary, there are not sources or sourcetypes. This is a single instance and I found that I had issues with my first data source of meraki over syslog because there was no inputs.conf in the local directory. Adding it with the appropriate line resolved this and the respective TA was able to index and I was able to search that data.
Is there something I am missing in the inputs.conf file that is needed for the Sophos Central TA to function?
Like, is there some line line restapi:/// or something that I need to add to get Splunk to realize that the app is installed with correct auth and header info?
I've looked at Sophos video which really isn't helpful and I have reviewed some of the app dev's comments but those did not answer this question. Assuming I wanted to add any restful API for a GET (not to POST into Splunk), what would I need to do with the inputs.conf file to get Splunk to understand that I added an input in the UI?
