[SailPoint] Get older events

[MandarinDefense]

Hello,

I enabled the app SailPoint Identity Security Cloud AuditEvent but I'd like to ingest older event. 

There is no option in the configuration (I think) to set the time range on which the Splunk app gather events.

Does anyone faced the same issue ?

Bye

[PickleRick]

The docs for the add-on - https://community.sailpoint.com/t5/Identity-Security-Cloud-Wiki/SailPoint-Identity-Security-Cloud-Au...

Say this:

NOTE: As of version 2.0.0, if the Splunk add-on loses its connection to Identity Security Cloud (manually disabled, credentials are removed, etc) for longer than a 24 hour period, it will begin collecting events from the time of reactivation/reconnection. For administrators, this means that if the add-on collection is suspended longer than 24 hours, audit events for this time period will not be available in Splunk. These events will still be retrievable via the IdentityNow API's.

I would read it as "the app reads at most 24 hours of backlog data". And it seems to be by design. You could fiddle with the add-on internals if it's in a readable form (I haven't checked if it's in python, as a binary or whatever).