All Apps and Add-ons

Palo Alto Networks App: How to disable Wildfire API Key query

DEAD_BEEF
Builder

Looking in splunkd.log I noticed these two errors repeated thousands of times. It looks like the Palo Alto app is trying to query for the Wildfire api key, but we do not use the Wildfire service here. How can I go about disabling this? I did see this posted, but that is already disabled and I am still seeing this error.

index=_internal sourcetype=splunk_python

.

ERROR common:183 - No Wildfire API key is set, set apikey in App configuration.

ERROR common:182 -   File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 143, in <module>
    main_splunk()
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 116, in main_splunk
    wf_apikey = common.get_wildfire_apikey(sessionKey)
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 98, in get_wildfire_apikey
    exit_with_error("No Wildfire API key is set, set apikey in App configuration.")
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 182, in exit_with_error
    logger.error(''.join(traceback.format_stack()))
0 Karma
1 Solution

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

View solution in original post

0 Karma

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...