By default, the Box Add-on is designed to support dynamical fields query for Box user information. So for your case, after you editting box.conf to add the new fields "tracking_code" to the "user_fields" and if Box API responses with tracking_code then you should be able to get the tracking_code indexed into Splunk.
In order to verify this. please do the followings:
1) enable the log level to DEBUG
2) check the ta_box.log to see the REST request sent to Box for user information. Make sure the "tracking_code" is in the request URL.
3) Run "curl" against the URL which has "tracking_code" to verify the "tracking_code" is responded by Box. The curl command will be something like this:
curl https://api.box.com/2.0/users? fields=type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users, is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,enterprise,my_tags,tracking_code -H "Authorization: Bearer ACCESS_TOKEN"
Note: by default box user is scheduled to run every 7 days. So once the box user info has been indexed, they will not be indexed again until the expiration. You can change the interval of the data collection to a small one through data inputs to make you changes effective in a small amount of time.
... View more
