All Apps and Add-ons

Box add-on Errors


Hi all,

I've read the troubleshooting page regarding Oauth session tokens (Can't post a link due to karma) and how they refresh every 2 hours, however I'm getting the following entries every 2/3mins (Not every 2hours as the troubleshooting guide states) Found by running the following search: eventtype=box_ta_log_error

docs.splunk .com/Documentation/AddOns/released/Box/Troubleshooting#OAuth_access_token_and_refresh_token_expiration_behavior

As far as I can tell the add-on is configured correctly, and is receiving events, but these errors are a bit erroneous.

2019-04-16 08:11:19,609 ERROR 140034471249664 - Failed to connect url=, input_name=box_service://BoxInputEvents, endpoint=events, message={"error":"invalid_client","error_description":"The client credentials are invalid"}, status=400, code=, context_info=Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/", line 134, in make_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/client/", line 317, in make_request
    return self._session.request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 456, in request
    response = self._prepare_and_send_request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 299, in _prepare_and_send_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 380, in _make_request
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 183, in _retry_request_if_necessary
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/", line 148, in _renew_session
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 209, in refresh
    return self._refresh(access_token_to_refresh)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 164, in _refresh
    return self.send_token_request(data, access_token)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/", line 289, in send_token_request
    raise BoxOAuthException(network_response.status_code, network_response.content, url, 'POST')
Message: {"error":"invalid_client","error_description":"The client credentials are invalid"}
Status: 400
Method: POST


Hi All, is there a solution for this problem?

0 Karma


I just received the same error.
Can someone let us know what this was fixed?
Did you have to authenticate again using your Box account?


After every change I make in the add-on, I have to re-add the client secret and then allow the app with the service account I am using with box.

0 Karma


This could happen even there is no change to the add-on, simply restarting splunk may resulting same problem. Keep re-adding the client secret/granting access on box is very annoying. I'm going to try the newly release 3.0.0 fixes. Hope it is fixed there.

0 Karma


Hi All,

Was wondering if you guys found a solution for this yet. If so, can you please share your solution.

Thank you

0 Karma

Path Finder

I'm actually getting the same errors. While I'm getting basic events, I'm not getting the folder, group, or user events. Any ideas?

0 Karma

Path Finder

I have, indeed. I'm kind of hoping it's a credential issue on the Box side, but there's not a lot to support that yet. Still looking into it.

0 Karma


Have you defined all the inputs on the add-on configuration page?

I have inputs for Events, Folders, Groups & Users, you need to configure each input separately and with the associated intervals.

0 Karma



This seems to be error of bad request.Could you confirm if you are sending request to correct url?

Let me know if this helps!!

0 Karma


I followed that guide to the letter.

Which URL are you specifically talking about. The instructions guide you to the box developer page where I have created the box application successfully. I have also pasted the correct URI from splunk into the configuration of the app.

I could understand if this was the token timing out, but it's not every 2 hours, it's every 2 minutes and throwing an error to the splunk web interface under "Messages"

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...