All Apps and Add-ons

Box Add-On Full Path for Items

kprior201_lilly
Path Finder

In the release notes for 2.1.0 Splunk Add-On for Box, it mentions "Ability to enable viewing of the entire parent structure of an asset.". I've yet to see this in any events. I've enabled all of data collection capable that is specified in the inputs.conf.spec. I'm not really sure what I'm missing. Anyone have any ideas? It would be incredibly useful to have the entire parent path.

Thanks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

kprior201_lilly
Path Finder

This worked. I feel silly. Thank you!!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great @kprior201_lilly

Can you please upvote & accept this answer and close it?

0 Karma

kprior201_lilly
Path Finder

Okay; if you leave the folder/file fields empty, I was assuming it would just pull ALL of the fields. I'll add the path_collection to them and see if it makes a difference.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...