Using Splunk 6.3.1 and SplunkforPaloAltoNetworks 5.0 trying to add WildFire API Key via UI. Is there a way to just add this via config or CLI?
Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/SplunkforPaloAltoNetworks/storage/passwords/
If i leave the WildFire API Key blank it says "Successfully updated "SplunkforPaloAltoNetworks"."
Contents of splunk/etc/apps/SplunkforPaloAltoNetworks/local/app.conf
[install]
state = enabled
Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf
instead of local/app.conf
. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.
For example:
rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart
Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf
instead of local/app.conf
. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.
For example:
rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart