All Apps and Add-ons

BOX TA for Splunk issues

abbasvakil
Observer

I configured Splunk's latest Box TA and I am receiving "Connection reset by peer" any suggestions on what the issue could be? Following is a snippet from splunkd.log

 

09-29-2021 18:56:48.754 -0400 ERROR ExecProcessor - message from "/opt/splunk/splunk/bin/python3.7 /opt/splunk/splunk/etc/apps/Splunk_TA_box/bin/box_service.py" WARNING:boxsdk.network.default_network:Request "GET https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=0&created_after=2021..." failed with ConnectionError exception: ConnectionError(ProtocolError('Connection aborted.', ConnectionResetError(104, 'Connection reset by peer')))

 

My box.conf for the TA is as follows

 

##
## SPDX-FileCopyrightText: 2021 Splunk, Inc. <sales@splunk.com>
## SPDX-License-Identifier: LicenseRef-Splunk-1-2020
##
##
[box_default]
folder_fields = type,id,name,size,sequence_id,etag,item_status,permissions,created_at,modified_at,has_collaborations,can_non_owners_invite,tags,created_by,modified_by,parent,path_collection,shared_link
collaboration_fields = type,id,created_by,created_at,modified_at,expires_at,status,accessible_by,role,acknowledged_at,item
file_fields = type,id,name,owned_by,comment_count,version_number,created_at,modified_at,purged_at,trashed_at,size,content_created_at,content_modified_at,file_version,description,path_collection,shared_link
task_fields = type,id,item,due_at,action,message,is_completed,created_by,created_at
comment_fields = type,id,is_reply_comment,message,tagged_message,item,modified_at,created_by,created_at
user_fields = type,id,name,login,created_at,modified_at,role,timezone,space_amount,space_used,max_upload_size,can_see_managed_users,is_external_collab_restricted,status,job_title,phone,address,avatar_url,is_exempt_from_device_limits,is_exempt_from_login_verification,enterprise,my_tags
created_after =
collection_interval = 120
priority = 10
record_count = 500
use_thread_pool = 1
url = https://api.box.com
restapi_base = https://api.box.com/2.0
disable_ssl_certificate_validation = True

Labels (1)
0 Karma

edhealea
Path Finder

Did you find a resolution to this issue? I am having the same issue after upgrading from 3.2.0 to 3.3.2.
Thanks

0 Karma

abbasvakil
Observer

No I have not figured out a solution. I have narrowed down the issue to when routing API calls via a proxy. It works fine in a non-proxy environment. I first thought the issue is around certificates etc and imported them also with no luck

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...