After successfully authenticating and granting access to our account on the Box side, when we return to the "Box REST API Setup" page and press "Save", we get the following error:
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/SplunkForBox/boxauth/doboxauth/default
This same process worked fine on our dev system (which is an all-in-one Splunk install), however on our distributed production Splunk instance we get this error. We're at a bit of a loss to figure out where the error lies...Where is this trying to POST to, etc...
Anyone solve this issue that can share?
I finally have an answer for this problem that may help you.
In our case, as per my comment, the issue is that our production Splunk search head has no Internet facing services. No DNS, no HTTPS. Everything must be done through an authenticated proxy for HTTP/HTTPS.
In order to get the Box for Splunk App working, I did the following:
Edit $SPLUNK_HOME/etc/splunk-launch.conf to contain the following:
HTTP_PROXY = http://127.0.0.1:3128
HTTPS_PROXY = http://127.0.0.1:3128
Install "cntlm" from http://cntlm.sourceforge.net
Configure cntlm to perform NTLMv2 authentication via our proxy and listen on 3128
Restart Splunk
From there, things just worked.
The initial problem I had was that the Splunk documentation says that the HTTP_PROXY requires just an IP address; however, that didn't work. It needed the actual "http://" as well -- now, in theory, you might be able to use HTTP_PROXY=http://user:pass@proxy.address:port
, but I haven't tried that, as leaving a password in a conf file like this isn't a good idea...
I think I understand the reason for this failure, but haven't found a solution. In our case, our Splunk server is behind a proxy that requires authentication on a network with no DNS resolution. When you attempt to save the OAuth token, the Box App for Splunk will try to connect to api.box.com directly - NOT using the HTTP_PROXY as defined in plunk-launch.conf - which generates an error in splunkd.log along the lines of:
File "/opt/splunk/lib/python2.7/socket.py", line 553, in create_connection\n for res in getaddrinfo(host, port, 0, SOCK_STREAM):\nIOError: [Errno socket error] [Errno -2] Name or service not known\n
I'm not sure how to get around this; unless the Box App for Splunk supports the proxy, it won't be able to reach out to api.box.com.
have you found the solution to this?