All Apps and Add-ons

Palo Alto Networks App: How to disable Wildfire API Key query

DEAD_BEEF
Builder

Looking in splunkd.log I noticed these two errors repeated thousands of times. It looks like the Palo Alto app is trying to query for the Wildfire api key, but we do not use the Wildfire service here. How can I go about disabling this? I did see this posted, but that is already disabled and I am still seeing this error.

index=_internal sourcetype=splunk_python

.

ERROR common:183 - No Wildfire API key is set, set apikey in App configuration.

ERROR common:182 -   File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 143, in <module>
    main_splunk()
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 116, in main_splunk
    wf_apikey = common.get_wildfire_apikey(sessionKey)
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 98, in get_wildfire_apikey
    exit_with_error("No Wildfire API key is set, set apikey in App configuration.")
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 182, in exit_with_error
    logger.error(''.join(traceback.format_stack()))
0 Karma
1 Solution

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

View solution in original post

0 Karma

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...