Palo Alto Networks App: How to disable Wildfire API Key query

[DEAD_BEEF]

Looking in splunkd.log I noticed these two errors repeated thousands of times. It looks like the Palo Alto app is trying to query for the Wildfire api key, but we do not use the Wildfire service here. How can I go about disabling this? I did see this posted, but that is already disabled and I am still seeing this error.

index=_internal sourcetype=splunk_python

.

ERROR common:183 - No Wildfire API key is set, set apikey in App configuration.

ERROR common:182 -   File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 143, in <module>
    main_splunk()
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 116, in main_splunk
    wf_apikey = common.get_wildfire_apikey(sessionKey)
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 98, in get_wildfire_apikey
    exit_with_error("No Wildfire API key is set, set apikey in App configuration.")
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 182, in exit_with_error
    logger.error(''.join(traceback.format_stack()))

[DEAD_BEEF · Accepted solution]

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.