Splunk integration details.

1) Set Splunk TRUNCATE property to 200K or more in Splunk props.conf. By default splunk truncates events by 10K characters, 
   hence following setting is recommended when Audit logs are enabled in SEPM.

TRUNCATE = 200000


2) Download and install splunk sdk for python

https://github.com/splunk/splunk-sdk-python


3) Set PYTHONPATH to splunk sdk folder.

SET PYTHONPATH=c:\splunk-sdk-pyhton


4) Open SepmPolicyDiffs.py in text editor and update Splunk credentials

5) Run SepmPolicyDiffs.py "source=<configuration>" 

python SepmPolicyDiffs.py "source=tcp:1546"
