Description
Wazuh | Splunk | Rev |
---|---|---|
4.3 | 8.1.4 | 4301 |
Description
This issue is related to the browser's cache.
The API information, included its ID or KEY, is stored on the browser's session storage. If the Splunk platform changes, for example, after an upgrade from a Splunk v8.2.5 to a Splunk v8.2.6, and the browser is not closed or refreshed, the information about the previous API is kept on the session storage. The API ID was generated by the previous Splunk's KVstore (database), so when this KEY is provided to our backend, the API cannot be found as it does not exist on the current Splunk's KVstore.
However, the error message is confusing, as the API ID is provided to the backend, only that it is not valid.
Steps to reproduce
- Create a Splunk environment, install the App and add an API.
- Change the environment to a different version of Splunk. Do not close or refresh the browser.
- Install the App on the new environment and launch the App.
- See the
Missing API ID
error.
Screenshots
Additional context
Content of /opt/splunk/var/log/splunk/SplunkAppForWazuh.log
ERROR: 2022/06/03 16:19:37: 'Error updating in DB module: Missing API ID'
ERROR: 2022/06/03 16:19:37: 'Error checking API connection: Missing API ID'
ERROR: 2022/06/03 16:19:37: 'Error updating in DB module: Missing API ID'
ERROR: 2022/06/03 16:19:37: 'Error checking API connection: Missing API ID'
ERROR: 2022/06/03 16:19:38: 'Error updating in DB module: Missing API ID'
ERROR: 2022/06/03 16:19:38: 'api: Error making API request: Missing API ID'
ERROR: 2022/06/03 16:19:38: 'Error updating in DB module: Missing API ID'
ERROR: 2022/06/03 16:19:38: 'api: Error making API request: Missing API ID'