Box Add-On Full Path for Items

[kprior201_lilly]

In the release notes for 2.1.0 Splunk Add-On for Box, it mentions "Ability to enable viewing of the entire parent structure of an asset.". I've yet to see this in any events. I've enabled all of data collection capable that is specified in the inputs.conf.spec. I'm not really sure what I'm missing. Anyone have any ideas? It would be incredibly useful to have the entire parent path.

Thanks!

[kamlesh_vaghela · Accepted solution]

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

[kprior201_lilly]

This worked. I feel silly. Thank you!!

[kamlesh_vaghela]

Great @kprior201_lilly

Can you please upvote & accept this answer and close it?

[kprior201_lilly]

Okay; if you leave the folder/file fields empty, I was assuming it would just pull ALL of the fields. I'll add the path_collection to them and see if it makes a difference.

Thank you.