All Apps and Add-ons

Box App for Splunk on Splunk Cloud: How to configure list of internal domains?

jasoncornell
Explorer

How does a user configure the following on the Splunk Cloud?

From the directions:

Populate list of internal domains to enable Splunk to filter non-‐‐corporate domains.
1. Navigate to the domains.csv file contained in the Splunk For Box folder. The path is ~/etc/apps/BoxAppForSplunk/lookups
2. Modify the domains.csv file to contain your corporate domains. Fill in the corp_code of “1” next to each.

1 Solution

jasoncornell
Explorer

I figured out my question after posting so posting for others to read and for Box to update their documentation to help others on the Splunk Cloud.

  1. Go to Settings and Lookups
  2. Select Lookup table files
  3. Select Box App for Splunk under the App context and you will see the path of the domains.cvs shown below
  4. Create a csv in Excel with cell A1 = corp_code and cell B1 = corp_domain
  5. Enter the domains 1 per row in column B
  6. Enter the number 1 in reach row in column A where you have a domain in B
  7. Save the file as a csv
  8. Click new
  9. Browse for the domain.csv you just created and name it domains.csv. You will see 2 paths listed with the one you just uploaded as Private under sharing.
  10. Delete the Global domains.csv and you should see only the one you uploaded.
  11. Click on Permissions
  12. Change to All Apps and grant Everyone Read and Write and click save

Now the Box for Splunk app should read in your domains.csv file on Splunk Cloud to accurate display non-corp logins and events on the dashboards.

View solution in original post

jasoncornell
Explorer

I figured out my question after posting so posting for others to read and for Box to update their documentation to help others on the Splunk Cloud.

  1. Go to Settings and Lookups
  2. Select Lookup table files
  3. Select Box App for Splunk under the App context and you will see the path of the domains.cvs shown below
  4. Create a csv in Excel with cell A1 = corp_code and cell B1 = corp_domain
  5. Enter the domains 1 per row in column B
  6. Enter the number 1 in reach row in column A where you have a domain in B
  7. Save the file as a csv
  8. Click new
  9. Browse for the domain.csv you just created and name it domains.csv. You will see 2 paths listed with the one you just uploaded as Private under sharing.
  10. Delete the Global domains.csv and you should see only the one you uploaded.
  11. Click on Permissions
  12. Change to All Apps and grant Everyone Read and Write and click save

Now the Box for Splunk app should read in your domains.csv file on Splunk Cloud to accurate display non-corp logins and events on the dashboards.

ksolanki88
Explorer

did you get solution for this ?? am getting the same error. please share if you already solved it.

thanks

0 Karma

bujan_splunk
New Member

I did that but my problem is that I can't get the key. However, I found somewhere else that using a different browser fixes this. Chrome got me a little farther, now I get past some of these steps and I'm able to login to box. the problem is when I hit save in "Box REST API Setup", I get this error:

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/BoxAppForSplunk/boxauth/doboxauth/default

Now I don't have a clue

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...