All Apps and Add-ons

Box add-on Errors


Hi all,

I've read the troubleshooting page regarding Oauth session tokens (Can't post a link due to karma) and how they refresh every 2 hours, however I'm getting the following entries every 2/3mins (Not every 2hours as the troubleshooting guide states) Found by running the following search: eventtype=box_ta_log_error

docs.splunk .com/Documentation/AddOns/released/Box/Troubleshooting#OAuth_access_token_and_refresh_token_expiration_behavior

As far as I can tell the add-on is configured correctly, and is receiving events, but these errors are a bit erroneous.

2019-04-16 08:11:19,609 ERROR 140034471249664 - Failed to connect url=, input_name=box_service://BoxInputEvents, endpoint=events, message={"error":"invalid_client","error_description":"The client credentials are invalid"}, status=400, code=, context_info=Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/", line 134, in make_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/client/", line 317, in make_request
    return self._session.request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 456, in request
    response = self._prepare_and_send_request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 299, in _prepare_and_send_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 380, in _make_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 183, in _retry_request_if_necessary
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 148, in _renew_session
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 209, in refresh
    return self._refresh(access_token_to_refresh)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 164, in _refresh
    return self.send_token_request(data, access_token)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 289, in send_token_request
    raise BoxOAuthException(network_response.status_code, network_response.content, url, 'POST')
Message: {"error":"invalid_client","error_description":"The client credentials are invalid"}
Status: 400
Method: POST

New Member

Hi All, is there a solution for this problem?

0 Karma


I just received the same error.
Can someone let us know what this was fixed?
Did you have to authenticate again using your Box account?


After every change I make in the add-on, I have to re-add the client secret and then allow the app with the service account I am using with box.

0 Karma


This could happen even there is no change to the add-on, simply restarting splunk may resulting same problem. Keep re-adding the client secret/granting access on box is very annoying. I'm going to try the newly release 3.0.0 fixes. Hope it is fixed there.

0 Karma


Hi All,

Was wondering if you guys found a solution for this yet. If so, can you please share your solution.

Thank you

0 Karma

Path Finder

I'm actually getting the same errors. While I'm getting basic events, I'm not getting the folder, group, or user events. Any ideas?

0 Karma

Path Finder

I have, indeed. I'm kind of hoping it's a credential issue on the Box side, but there's not a lot to support that yet. Still looking into it.

0 Karma


Have you defined all the inputs on the add-on configuration page?

I have inputs for Events, Folders, Groups & Users, you need to configure each input separately and with the associated intervals.

0 Karma



This seems to be error of bad request.Could you confirm if you are sending request to correct url?

Let me know if this helps!!

0 Karma


I followed that guide to the letter.

Which URL are you specifically talking about. The instructions guide you to the box developer page where I have created the box application successfully. I have also pasted the correct URI from splunk into the configuration of the app.

I could understand if this was the token timing out, but it's not every 2 hours, it's every 2 minutes and throwing an error to the splunk web interface under "Messages"

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...