All Apps and Add-ons

Palo Alto Networks App for Splunk: Why am I getting "Error while posting to url=/.../storage/passwords/" trying to add WildFire API Key via the UI?

kmanson
Path Finder

Using Splunk 6.3.1 and SplunkforPaloAltoNetworks 5.0 trying to add WildFire API Key via UI. Is there a way to just add this via config or CLI?

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/SplunkforPaloAltoNetworks/storage/passwords/

If i leave the WildFire API Key blank it says "Successfully updated "SplunkforPaloAltoNetworks"."

Contents of splunk/etc/apps/SplunkforPaloAltoNetworks/local/app.conf

[install]
state = enabled
1 Solution

btorresgil
Builder

Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf instead of local/app.conf. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.

For example:

rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart

View solution in original post

btorresgil
Builder

Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf instead of local/app.conf. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.

For example:

rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...