Splunk Add-on for Box -Not ingesting data due to invalid "created_after" parameter on API Configuration

Applicability

Splunk Enterprise Splunk Cloud Splunk Apps and Add-on

Description

The Splunk Add-on for Box is encountering ingestion issues due to an invalid "created_after" parameter configuration within the API settings. This misconfiguration prevents the proper retrieval and ingestion of Box data into Splunk

Investigation

Check error logs using below SPL

SPL:

index=_internal *Box* log_level=ERROR

ERROR:

2023-12-11 20:50:42,562 ERROR pid=2497307 tid=139912162682624 tname=Thread-5 filename=box_data_loader.py::_send_request #242 | Failed to connect url=https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=1152923153366002570&created_after=2022-03-31T20:40:15-00:00&created_before=2023-12-11T20:50:42-00:00, input_name=box_service://Box_Events, endpoint=events, message=created_after is beyond one year in the past, API only supports time range starting from one year in the past from now, status=400, code=bad_request, context_info=Traceback (most recent call last): File "/opt/splunk/etc/apps/Splunk_TA_box/bin/box_client.py", line 198, in make_request params=params, File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/util/api_call_decorator.py", line 63, in call return method(*args, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/client/client.py", line 1144, in make_request return self._session.request(method, url, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/session/session.py", line 138, in request response = self._prepare_and_send_request(method, url, **kwargs) File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/session/session.py", line 362, in _prepare_and_send_request self._raise_on_unsuccessful_request(network_response, request, raised_exception) File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/session/session.py", line 280, in _raise_on_unsuccessful_request network_response=network_response boxsdk.exception.BoxAPIException: Message: created_after is beyond one year in the past, API only supports time range starting from one year in the past from now Status: 400 Code: bad_request Request ID: 2imrfphkqix7bhs7 Headers: {'Date': 'Mon, 11 Dec 2023 20:50:42 GMT', 'Content-Type': 'application/json', 'x-envoy-upstream-service-time': '284', 'box-request-id': '02186fd0a62da0cd7978258ff6eebf3b5', 'cache-control': 'no-cache, no-store', 'strict-transport-security': 'max-age=31536000', 'Via': '1.1 google', 'Alt-Svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000', 'Transfer-Encoding': 'chunked'} URL: https://api.box.com/2.0/events?stream_type=admin_logs&limit=500&stream_position=1152923153366002570&created_after=2022-03-31T20:40:15-00:00&created_before=2023-12-11T20:50:42-00:00 Method: GET Context Info: None

 

 

Resolution

The Box API currently limits historical event data collection to one year. If you set a date farther in the past than one year ago when you set up the add-on, you encounter this error. The add-on does not collect event data or set a checkpoint, so you can correct the start date to one within one year and restart data collection to recover.

Related Links

Splunk Add-on for Box troubleshooting documents
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release