All Apps and Add-ons

Palo Alto Networks App for Splunk: Why am I getting "Error while posting to url=/.../storage/passwords/" trying to add WildFire API Key via the UI?

kmanson
Path Finder

Using Splunk 6.3.1 and SplunkforPaloAltoNetworks 5.0 trying to add WildFire API Key via UI. Is there a way to just add this via config or CLI?

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/SplunkforPaloAltoNetworks/storage/passwords/

If i leave the WildFire API Key blank it says "Successfully updated "SplunkforPaloAltoNetworks"."

Contents of splunk/etc/apps/SplunkforPaloAltoNetworks/local/app.conf

[install]
state = enabled
1 Solution

btorresgil
Builder

Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf instead of local/app.conf. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.

For example:

rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart

View solution in original post

btorresgil
Builder

Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf instead of local/app.conf. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.

For example:

rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...