All Apps and Add-ons

Box Add-On Full Path for Items

kprior201_lilly
Explorer

In the release notes for 2.1.0 Splunk Add-On for Box, it mentions "Ability to enable viewing of the entire parent structure of an asset.". I've yet to see this in any events. I've enabled all of data collection capable that is specified in the inputs.conf.spec. I'm not really sure what I'm missing. Anyone have any ideas? It would be incredibly useful to have the entire parent path.

Thanks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

View solution in original post

kprior201_lilly
Explorer

This worked. I feel silly. Thank you!!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great @kprior201_lilly

Can you please upvote & accept this answer and close it?

0 Karma

kprior201_lilly
Explorer

Okay; if you leave the folder/file fields empty, I was assuming it would just pull ALL of the fields. I'll add the path_collection to them and see if it makes a difference.

Thank you.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!