Splunk Add-on for Box: Live Monitoring Input Stops Due to Box SDK Issues

Applicability

Description

The unexpected stoppage of Live Monitoring Input in the Splunk Add-on for Box in version 3.12.0 was identified as a result of a timeout handling issue in the Box SDK. 

This known issue stems from the SDK’s inability to manage timeouts effectively and its limited configuration options, leading to interruptions in live data monitoring.

Investigation

Initially, the absence of error logs suggested potential issues on the API side. 

A thorough investigation involving the engineering team pinpointed the root cause of the Box SDK. The SDK was found to mishandle timeout scenarios during API calls. 

Moreover, configuring critical parameters such as timeouts, proxy settings, and SSL verification requires overriding the DefaultNetwork.request method, which further complicates resolution.

The issue was reported on the [Box SDK GitHub repository], and the response received was as follows:

"Currently, the box-python-sdk is in a 'stable' state, meaning that known issues will be fixed, but no new features are being developed. Since this can be addressed by overriding the DefaultNetwork.request method, we won’t be implementing the proposed enhancement."

This limitation in the Box SDK has resulted in intermittent disruptions to the functionality of the Splunk Add-on for Box, affecting live monitoring reliability.

Resolution

Workaround:
If data ingestion halts, temporarily disable and re-enable the input to restore functionality.

This approach allows the data flow to resume until a permanent fix is available.

Planned Fix:
The engineering team is actively working on a code update to address the issue within the Splunk Add-on for Box. 

However, a timeline for the release of this update has not been finalized.