Hi, has anyone encountered issue with Palo Alto Aperture not pulling logs from Aperture API? It looks like I can successfully connect, but when it comes to fetching logs, some Region settings runs into errors. Here's what I see in the logs;
2019-02-12 12:13:41,430 INFO pid=16876 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1
2019-02-12 12:13:43,884 INFO pid=16876 tid=MainThread file=setup_util.py:log_info:114 | Log level is not set, use default INFO
2019-02-12 12:13:43,884 INFO pid=16876 tid=MainThread file=setup_util.py:log_info:114 | Log level is not set, use default INFO
2019-02-12 12:13:43,885 ERROR pid=16876 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/sh01/splunk/etc/apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/modinput_wrapper/base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "/opt/sh01/splunk/etc/apps/Splunk_TA_paloalto/bin/aperture.py", line 64, in collect_events
input_module.collect_events(self, ew)
File "/opt/sh01/splunk/etc/apps/Splunk_TA_paloalto/bin/input_module_aperture.py", line 78, in collect_events
url_domain = REGION_DOMAIN[region]
KeyError: None
I've setup the add-on with "US" as selected region. Any ideas what could be the issue?
