All Apps and Add-ons

Splunk Add-on for Box works on 7.3.2 but on 7.3.3 it gives [Loading] Input page

yuichirosuzuki
Explorer

Hi,

I faced the issue with Splunk Add-on for Box.

Splunk Enterprise(Single Instance):7.3.3 OS:Cent 8 / Win10
Splunk Add-on for Box:2.1
-> Inputs page is stacked [Loading]

Splunk Enterprise(Single Instance):7.3.2 OS:Cent 8 / Win10
Splunk Add-on for Box:2.1
-> Inputs page is displayed normal.

both I did minimum setting change
1. install Splunk Enterprise
2. enable SSL
3. install Apps:Splunk Add-on for Box
4.issue happen

Does anyone have workaround or information ?
Thanks,

howyagoin
Contributor

I probably should have made my Comment a possible Answer, sorry.

This is what I put in my box.conf file for the 7.3.3 system. The values came from a previously working Box app installation on an older Splunk. Likely these field names will help. The rest of the solution was just setting up authentication and/or proxy settings.

Worked for me.

[box_default]
folder_fields = type,id,name,size,sequence_id,etag,item_status,permissions,created_at,modified_at,has_collaborations,can_non_owners_invite,tags,created_by,modified_by,parent,path_collection,shared_link
collaboration_fields = type,id,created_by,created_at,modified_at,expires_at,status,accessible_by,role,acknowledged_at,item
file_fields = type,id,name,owned_by,comment_count,version_number,created_at,modified_at,purged_at,trashed_at,size,content_created_at,content_modified_at,file_version,description,path_collection,shared_link
task_fields = type,id,item,due_at,action,message,is_completed,created_by,created_at
comment_fields = type,id,is_reply_comment,message,tagged_message,item,modified_at,created_by,created_at
user_fields = type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users,is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,enterprise,my_tags
created_after =
collection_interval = 120
priority = 10
record_count = 500
use_thread_pool = 1
url = https://api.box.com
restapi_base = https://api.box.com/2.0
disable_ssl_certificate_validation = False
0 Karma

howyagoin
Contributor

My workaround for this problem was to go to an older Box setup and copy the box.conf file to a newer system, which seems to have set most of the settings correctly.

folder_fields = type,id,name,size,sequence_id,etag,item_status,permissions,created_at,modified_at,has_collaborations,can_non_owners_invite,tags,created_by,modified_by,parent,path_collection,shared_link
collaboration_fields = type,id,created_by,created_at,modified_at,expires_at,status,accessible_by,role,acknowledged_at,item
file_fields = type,id,name,owned_by,comment_count,version_number,created_at,modified_at,purged_at,trashed_at,size,content_created_at,content_modified_at,file_version,description,path_collection,shared_link
task_fields = type,id,item,due_at,action,message,is_completed,created_by,created_at
comment_fields = type,id,is_reply_comment,message,tagged_message,item,modified_at,created_by,created_at
user_fields = type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users,is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,enterprise,my_tags
created_after =
collection_interval = 120
priority = 10
record_count = 500
use_thread_pool = 1
url = https://api.box.com
restapi_base = https://api.box.com/2.0
disable_ssl_certificate_validation = False

From there, it was mostly a matter of configuring the Box app to work with/without a proxy, sort out the account name, tokens, and so on - just as per the documentation.

0 Karma

fahmed11
Explorer

I see this box.conf file with these configs already in /splunk/etc/apps/Splunk_TA_box/default/ on Splunk 7.3.3.

Did your add-on work after this?

0 Karma

yuichirosuzuki
Explorer

Thank you for your information.

[Data inputs] page will be one of the workaound if we know how to fill in.

0 Karma

yutaka1005
Builder

I face the same problem.
But I was able to avoid it by following steps.

  1. Login to Splunk Web
  2. Open [Settings]
  3. Open [Data inputs]
  4. Open [Splunk Add-on for Box]
  5. Open [New]

However, the settings are different from the default settings page of Box Add-on, so you need to know what to set.

0 Karma

fahmed11
Explorer

Can you provide instructions on how to fill this out for the Box add-on?

0 Karma

yutaka1005
Builder

I face the same problem.
Just installing Add-on, 7.3.3 didn't display inputs page, but 7.3.2 displayed it.

0 Karma

yuichirosuzuki
Explorer

I shoud use [stuck] not [stack].. sorry for typo.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...