Palo Alto Networks App for Splunk: Why am I getting "Error while posting to url=/.../storage/passwords/" trying to add WildFire API Key via the UI?

[kmanson]

Using Splunk 6.3.1 and SplunkforPaloAltoNetworks 5.0 trying to add WildFire API Key via UI. Is there a way to just add this via config or CLI?

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/SplunkforPaloAltoNetworks/storage/passwords/

If i leave the WildFire API Key blank it says "Successfully updated "SplunkforPaloAltoNetworks"."

Contents of splunk/etc/apps/SplunkforPaloAltoNetworks/local/app.conf

[install]
state = enabled

[btorresgil · Accepted solution]

Hi kmanson. Usually that error means the wildfire api key is already set. Starting in Splunk 6.3.0 the credentials and api key are now stored in local/passwords.conf instead of local/app.conf. Try deleting the passwords.conf file (or remove the wildfire api key from it), then restart Splunk. That should clear it out so you can try to add the API key again in the app configuration screen.

For example:

rm $SPLUNK_HOME/etc/apps/SplunkforPaloAltoNetworks/local/passwords.conf
$SPLUNK_HOME/bin/splunk restart