All Apps and Add-ons

Splunk Add-on for Box: How to index additional fields in the user object?

New Member

TLDR- Is the application indexing items other than the events stream?

I'm trying to search some of the "tracking_codes" for users in my Box instance to report on usage by groups, for example "Sales", and this is not being returned in the splunk events. (Tracking codes can be enabled by the Box customer success teams for enterprise customers).

I first edited the box.conf file to add the appropriate user fields:

user_fields = type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users,is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,tracking_codes,enterprise,my_tags

I created a new user in Box with tracking codes set:

"type": "user",
"id": "240685827",
"name": "Danno Tracking Code Test",
"login": "",
"created_at": "2015-06-23T11:00:33-07:00",
"modified_at": "2015-06-23T11:10:44-07:00",
"language": "en",
"timezone": "America\/Los_Angeles",
"space_amount": 1000000000000000,
"space_used": 1255288,
"max_upload_size": 16106127360,
"status": "active",
"job_title": "",
"phone": "",
"address": "",
"avatar_url": "https:\/\/\/api\/avatar\/large\/240685827"

When I add the "fields" parameter with "tracking_codes", it returns:

"type": "user",
"id": "24068NNNN",
"tracking_codes": [
"type": "tracking_code",
"name": "Sales",
"value": "Field Team"
"type": "tracking_code",
"name": "Finance",
"value": "2300"
"type": "tracking_code",
"name": "APAC",
"value": "Bravo"

In Splunk however, I think that these optional fields aren't being indexed: You can see that the sourcetype is box:events

Per the Box documentation, at

Fields Support: The fields parameter
is not yet supported for GET /events,
POST /files/content, and POST

Question- since some of these optional fields are set and appear to be in use, how do we get them indexed?

0 Karma

Splunk Employee
Splunk Employee

By default, the Box Add-on is designed to support dynamical fields query for Box user information. So for your case, after you editting box.conf to add the new fields "tracking_code" to the "user_fields" and if Box API responses with tracking_code then you should be able to get the tracking_code indexed into Splunk.

In order to verify this. please do the followings:
1) enable the log level to DEBUG
2) check the ta_box.log to see the REST request sent to Box for user information. Make sure the "tracking_code" is in the request URL.
3) Run "curl" against the URL which has "tracking_code" to verify the "tracking_code" is responded by Box. The curl command will be something like this:
curl fields=type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users, is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,enterprise,my_tags,tracking_code -H "Authorization: Bearer ACCESS_TOKEN"

Note: by default box user is scheduled to run every 7 days. So once the box user info has been indexed, they will not be indexed again until the expiration. You can change the interval of the data collection to a small one through data inputs to make you changes effective in a small amount of time.

Splunk Employee
Splunk Employee


your best route to getting a feature added is to file an enhancement request through support.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...