All Apps and Add-ons

Box Add-On Full Path for Items

kprior201_lilly
Path Finder

In the release notes for 2.1.0 Splunk Add-On for Box, it mentions "Ability to enable viewing of the entire parent structure of an asset.". I've yet to see this in any events. I've enabled all of data collection capable that is specified in the inputs.conf.spec. I'm not really sure what I'm missing. Anyone have any ideas? It would be incredibly useful to have the entire parent path.

Thanks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kprior201_lilly

I think it should be in location field. Can you please search location filed in box:file OR box:folder?

Also make sure path_collection in box.conf.

[box_default]
folder_fields = ...,path_collection,...
file_fields = ...,path_collection,...

Box 2.1 has this field,if it is not there means any local copy of box.conf with same stazna and property may there which can impact collection of location field.

kprior201_lilly
Path Finder

This worked. I feel silly. Thank you!!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great @kprior201_lilly

Can you please upvote & accept this answer and close it?

0 Karma

kprior201_lilly
Path Finder

Okay; if you leave the folder/file fields empty, I was assuming it would just pull ALL of the fields. I'll add the path_collection to them and see if it makes a difference.

Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...