Box App for Splunk on Splunk Cloud: How to configure list of internal domains?

[jasoncornell]

How does a user configure the following on the Splunk Cloud?

From the directions:

Populate list of internal domains to enable Splunk to filter non-‐‐corporate domains.
1. Navigate to the domains.csv file contained in the Splunk For Box folder. The path is ~/etc/apps/BoxAppForSplunk/lookups
2. Modify the domains.csv file to contain your corporate domains. Fill in the corp_code of “1” next to each.


[jasoncornell · Accepted solution]

I figured out my question after posting so posting for others to read and for Box to update their documentation to help others on the Splunk Cloud.

1. Go to Settings and Lookups
2. Select Lookup table files
3. Select Box App for Splunk under the App context and you will see the path of the domains.cvs shown below
4. Create a csv in Excel with cell A1 = corp_code and cell B1 = corp_domain
5. Enter the domains 1 per row in column B
6. Enter the number 1 in reach row in column A where you have a domain in B
7. Save the file as a csv
8. Click new
9. Browse for the domain.csv you just created and name it domains.csv. You will see 2 paths listed with the one you just uploaded as Private under sharing.
10. Delete the Global domains.csv and you should see only the one you uploaded.
11. Click on Permissions
12. Change to All Apps and grant Everyone Read and Write and click save

Now the Box for Splunk app should read in your domains.csv file on Splunk Cloud to accurate display non-corp logins and events on the dashboards.

[ksolanki88]

did you get solution for this ?? am getting the same error. please share if you already solved it.

thanks

[bujan_splunk]

I did that but my problem is that I can't get the key. However, I found somewhere else that using a different browser fixes this. Chrome got me a little farther, now I get past some of these steps and I'm able to login to box. the problem is when I hit save in "Box REST API Setup", I get this error:

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/BoxAppForSplunk/boxauth/doboxauth/default

Now I don't have a clue