Sophos Central app for Splunk: which Splunk logs should I check to find errors?

[dperusich]

Hello,

I've installed, configured, and fixed the typo in sophos_events.py, but the app is not pulling data from Sophos Central/Cloud. Are there any debug settings that can be set, or which Splunk logs should I check to find errors? The API key I'm using works, I've tested it with https://github.com/sophos/Sophos-Central-SIEM-Integration.

Thanks!

[sergejreliance]

1. $SPLUNK_HOME/var/log/splunk/splunkd.log is good starting point. Search for Sophos or Pyton keywords.
2. index=_internal will contain same details