All Apps and Add-ons

Palo Alto Networks App: How to disable Wildfire API Key query

DEAD_BEEF
Builder

Looking in splunkd.log I noticed these two errors repeated thousands of times. It looks like the Palo Alto app is trying to query for the Wildfire api key, but we do not use the Wildfire service here. How can I go about disabling this? I did see this posted, but that is already disabled and I am still seeing this error.

index=_internal sourcetype=splunk_python

.

ERROR common:183 - No Wildfire API key is set, set apikey in App configuration.

ERROR common:182 -   File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 143, in <module>
    main_splunk()
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 116, in main_splunk
    wf_apikey = common.get_wildfire_apikey(sessionKey)
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 98, in get_wildfire_apikey
    exit_with_error("No Wildfire API key is set, set apikey in App configuration.")
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 182, in exit_with_error
    logger.error(''.join(traceback.format_stack()))
0 Karma
1 Solution

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

View solution in original post

0 Karma

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...