Box add-on Errors

[montydo]

Hi all,

I've read the troubleshooting page regarding Oauth session tokens (Can't post a link due to karma) and how they refresh every 2 hours, however I'm getting the following entries every 2/3mins (Not every 2hours as the troubleshooting guide states) Found by running the following search: eventtype=box_ta_log_error

docs.splunk .com/Documentation/AddOns/released/Box/Troubleshooting#OAuth_access_token_and_refresh_token_expiration_behavior

As far as I can tell the add-on is configured correctly, and is receiving events, but these errors are a bit erroneous.

2019-04-16 08:11:19,609 ERROR 140034471249664 - Failed to connect url=https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=1152923059666091010&created_after=2019-04-12T08:55:20-00:00&created_before=2019-04-16T08:11:19-00:00, input_name=box_service://BoxInputEvents, endpoint=events, message={"error":"invalid_client","error_description":"The client credentials are invalid"}, status=400, code=, context_info=Traceback (most recent call last):
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/box_client.py", line 134, in make_request
    params=params)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/client/client.py", line 317, in make_request
    return self._session.request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 456, in request
    response = self._prepare_and_send_request(method, url, **kwargs)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 299, in _prepare_and_send_request
    **kwargs
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 380, in _make_request
    **kwargs
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 183, in _retry_request_if_necessary
    self._renew_session(network_response.access_token_used)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/session/box_session.py", line 148, in _renew_session
    self._oauth.refresh(access_token_used)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 209, in refresh
    return self._refresh(access_token_to_refresh)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 164, in _refresh
    return self.send_token_request(data, access_token)
  File "/opt/splunk/etc/apps/Splunk_TA_box/bin/boxsdk/auth/oauth2.py", line 289, in send_token_request
    raise BoxOAuthException(network_response.status_code, network_response.content, url, 'POST')
BoxOAuthException: 
Message: {"error":"invalid_client","error_description":"The client credentials are invalid"}
Status: 400
URL: https://api.box.com/oauth2/token
Method: POST

[sa128c]

Hi All, is there a solution for this problem?

[kcooper]

I just received the same error.
Can someone let us know what this was fixed?
Did you have to authenticate again using your Box account?

[soothsayer011]

After every change I make in the add-on, I have to re-add the client secret and then allow the app with the service account I am using with box.

[lianwan]

This could happen even there is no change to the add-on, simply restarting splunk may resulting same problem. Keep re-adding the client secret/granting access on box is very annoying. I'm going to try the newly release 3.0.0 fixes. Hope it is fixed there.

[shiv1593]

Hi All,

Was wondering if you guys found a solution for this yet. If so, can you please share your solution.

Thank you

[kprior201_lilly]

I'm actually getting the same errors. While I'm getting basic events, I'm not getting the folder, group, or user events. Any ideas?

[kprior201_lilly]

I have, indeed. I'm kind of hoping it's a credential issue on the Box side, but there's not a lot to support that yet. Still looking into it.

[montydo]

Have you defined all the inputs on the add-on configuration page?

I have inputs for Events, Folders, Groups & Users, you need to configure each input separately and with the associated intervals.

[deepashri_123]

Hey@montydo,

This seems to be error of bad request.Could you confirm if you are sending request to correct url?
https://docs.splunk.com/Documentation/AddOns/released/Box/ConfigurecredentialsonBox

Let me know if this helps!!

[montydo]

I followed that guide to the letter.

Which URL are you specifically talking about. The instructions guide you to the box developer page where I have created the box application successfully. I have also pasted the correct URI from splunk into the configuration of the app.

I could understand if this was the token timing out, but it's not every 2 hours, it's every 2 minutes and throwing an error to the splunk web interface under "Messages"