Error configuring Box for Splunk app on distributed production Splunk instance

[jessebow]

After successfully authenticating and granting access to our account on the Box side, when we return to the "Box REST API Setup" page and press "Save", we get the following error:

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/SplunkForBox/boxauth/doboxauth/default

This same process worked fine on our dev system (which is an all-in-one Splunk install), however on our distributed production Splunk instance we get this error. We're at a bit of a loss to figure out where the error lies...Where is this trying to POST to, etc...

Anyone solve this issue that can share?

[howyagoin]

I finally have an answer for this problem that may help you.

In our case, as per my comment, the issue is that our production Splunk search head has no Internet facing services. No DNS, no HTTPS. Everything must be done through an authenticated proxy for HTTP/HTTPS.

In order to get the Box for Splunk App working, I did the following:

• Install the Box for Splunk App

• Edit $SPLUNK_HOME/etc/splunk-launch.conf to contain the following:

  HTTP_PROXY = http://127.0.0.1:3128
  HTTPS_PROXY = http://127.0.0.1:3128

• Install "cntlm" from http://cntlm.sourceforge.net

• Configure cntlm to perform NTLMv2 authentication via our proxy and listen on 3128

• Restart Splunk

From there, things just worked.

The initial problem I had was that the Splunk documentation says that the HTTP_PROXY requires just an IP address; however, that didn't work. It needed the actual "http://" as well -- now, in theory, you might be able to use HTTP_PROXY=http://user:pass@proxy.address:port, but I haven't tried that, as leaving a password in a conf file like this isn't a good idea...

[howyagoin]

I think I understand the reason for this failure, but haven't found a solution. In our case, our Splunk server is behind a proxy that requires authentication on a network with no DNS resolution. When you attempt to save the OAuth token, the Box App for Splunk will try to connect to api.box.com directly - NOT using the HTTP_PROXY as defined in plunk-launch.conf - which generates an error in splunkd.log along the lines of:

File "/opt/splunk/lib/python2.7/socket.py", line 553, in create_connection\n    for res in getaddrinfo(host, port, 0, SOCK_STREAM):\nIOError: [Errno socket error] [Errno -2] Name or service not known\n

I'm not sure how to get around this; unless the Box App for Splunk supports the proxy, it won't be able to reach out to api.box.com.

[bujan_splunk]

have you found the solution to this?