All Apps and Add-ons

Box add-on Errors


Hi all,

I've read the troubleshooting page regarding Oauth session tokens (Can't post a link due to karma) and how they refresh every 2 hours, however I'm getting the following entries every 2/3mins (Not every 2hours as the troubleshooting guide states) Found by running the following search: eventtype=box_ta_log_error

docs.splunk .com/Documentation/AddOns/released/Box/Troubleshooting#OAuth_access_token_and_refresh_token_expiration_behavior

As far as I can tell the add-on is configured correctly, and is receiving events, but these errors are a bit erroneous.

2019-04-16 08:11:19,609 ERROR 140034471249664 - Failed to connect url=, input_name=box_service://BoxInputEvents, endpoint=events, message={"error":"invalid_client","error_description":"The client credentials are invalid"}, status=400, code=, context_info=Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/", line 134, in make_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/client/", line 317, in make_request
    return self._session.request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 456, in request
    response = self._prepare_and_send_request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 299, in _prepare_and_send_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 380, in _make_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 183, in _retry_request_if_necessary
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 148, in _renew_session
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 209, in refresh
    return self._refresh(access_token_to_refresh)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 164, in _refresh
    return self.send_token_request(data, access_token)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 289, in send_token_request
    raise BoxOAuthException(network_response.status_code, network_response.content, url, 'POST')
Message: {"error":"invalid_client","error_description":"The client credentials are invalid"}
Status: 400
Method: POST

New Member

Hi All, is there a solution for this problem?

0 Karma


I just received the same error.
Can someone let us know what this was fixed?
Did you have to authenticate again using your Box account?


After every change I make in the add-on, I have to re-add the client secret and then allow the app with the service account I am using with box.

0 Karma


This could happen even there is no change to the add-on, simply restarting splunk may resulting same problem. Keep re-adding the client secret/granting access on box is very annoying. I'm going to try the newly release 3.0.0 fixes. Hope it is fixed there.

0 Karma


Hi All,

Was wondering if you guys found a solution for this yet. If so, can you please share your solution.

Thank you

0 Karma

Path Finder

I'm actually getting the same errors. While I'm getting basic events, I'm not getting the folder, group, or user events. Any ideas?

0 Karma

Path Finder

I have, indeed. I'm kind of hoping it's a credential issue on the Box side, but there's not a lot to support that yet. Still looking into it.

0 Karma


Have you defined all the inputs on the add-on configuration page?

I have inputs for Events, Folders, Groups & Users, you need to configure each input separately and with the associated intervals.

0 Karma



This seems to be error of bad request.Could you confirm if you are sending request to correct url?

Let me know if this helps!!

0 Karma


I followed that guide to the letter.

Which URL are you specifically talking about. The instructions guide you to the box developer page where I have created the box application successfully. I have also pasted the correct URI from splunk into the configuration of the app.

I could understand if this was the token timing out, but it's not every 2 hours, it's every 2 minutes and throwing an error to the splunk web interface under "Messages"

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...