Hi all,
I've read the troubleshooting page regarding Oauth session tokens (Can't post a link due to karma) and how they refresh every 2 hours, however I'm getting the following entries every 2/3mins (Not every 2hours as the troubleshooting guide states) Found by running the following search: eventtype=box_ta_log_error
docs.splunk .com/Documentation/AddOns/released/Box/Troubleshooting#OAuth_access_token_and_refresh_token_expiration_behavior
As far as I can tell the add-on is configured correctly, and is receiving events, but these errors are a bit erroneous.
2019-04-16 08:11:19,609 ERROR 140034471249664 - Failed to connect url=https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=1152923059666091010&created_after=2019-04-12T08:55:20-00:00&created_before=2019-04-16T08:11:19-00:00, input_name=box_service://BoxInputEvents, endpoint=events, message={"error":"invalid_client","error_description":"The client credentials are invalid"}, status=400, code=, context_info=Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/box_client.py", line 134, in make_request
params=params)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/client/client.py", line 317, in make_request
return self._session.request(method, url, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 456, in request
response = self._prepare_and_send_request(method, url, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 299, in _prepare_and_send_request
**kwargs
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 380, in _make_request
**kwargs
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 183, in _retry_request_if_necessary
self._renew_session(network_response.access_token_used)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 148, in _renew_session
self._oauth.refresh(access_token_used)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 209, in refresh
return self._refresh(access_token_to_refresh)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 164, in _refresh
return self.send_token_request(data, access_token)
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 289, in send_token_request
raise BoxOAuthException(network_response.status_code, network_response.content, url, 'POST')
BoxOAuthException:
Message: {"error":"invalid_client","error_description":"The client credentials are invalid"}
Status: 400
URL: https://api.box.com/oauth2/token
Method: POST
Hi All, is there a solution for this problem?
I just received the same error.
Can someone let us know what this was fixed?
Did you have to authenticate again using your Box account?
After every change I make in the add-on, I have to re-add the client secret and then allow the app with the service account I am using with box.
This could happen even there is no change to the add-on, simply restarting splunk may resulting same problem. Keep re-adding the client secret/granting access on box is very annoying. I'm going to try the newly release 3.0.0 fixes. Hope it is fixed there.
Hi All,
Was wondering if you guys found a solution for this yet. If so, can you please share your solution.
Thank you
I'm actually getting the same errors. While I'm getting basic events, I'm not getting the folder, group, or user events. Any ideas?
I have, indeed. I'm kind of hoping it's a credential issue on the Box side, but there's not a lot to support that yet. Still looking into it.
Have you defined all the inputs on the add-on configuration page?
I have inputs for Events, Folders, Groups & Users, you need to configure each input separately and with the associated intervals.
Hey@montydo,
This seems to be error of bad request.Could you confirm if you are sending request to correct url?
https://docs.splunk.com/Documentation/AddOns/released/Box/ConfigurecredentialsonBox
Let me know if this helps!!
I followed that guide to the letter.
Which URL are you specifically talking about. The instructions guide you to the box developer page where I have created the box application successfully. I have also pasted the correct URI from splunk into the configuration of the app.
I could understand if this was the token timing out, but it's not every 2 hours, it's every 2 minutes and throwing an error to the splunk web interface under "Messages"