Splunk Add-on for Cisco Meraki : Not able to send logs due to permission issues at Meraki side.

Applicability

Splunk Apps & Add-ons Splunk Enterprise Splunk Cloud

Description

Splunk Add-on for Cisco Meraki is unable to send logs due to missing permissions on the Meraki side.

Investigation

Search for Sysmon data using below SPL:

index=* sourcetype=*Cisco* log_level=ERROR 

We found below Errors:

ERROR:

023-11-07 06:40:47,919 ERROR pid=14716 tid=MainThread file=cisco_meraki_base_script.py:stream_events:53 | Error while streaming events for input cisco_meraki_securityappliances://GBAT_Firewall: Traceback (most recent call last):
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\bin\cisco_meraki_base_script.py", line 49, in stream_events
    api.collect_events(event_writer)
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\bin\cisco_meraki_connect.py", line 210, in collect_events
    events = self._collect_events()
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\bin\cisco_meraki_connect.py", line 173, in _collect_events
    networks = self.get_organization_networks()
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\bin\cisco_meraki_connect.py", line 104, in get_organization_networks
    perPage=100000,
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\lib\meraki\api\organizations.py", line 1935, in getOrganizationNetworks
    return self._session.get_pages(metadata, resource, params, total_pages, direction)
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\lib\meraki\rest_session.py", line 378, in _get_pages_legacy
    response = self.request(metadata, 'GET', url, params=params)
  File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco_meraki\lib\meraki\rest_session.py", line 277, in request
    raise APIError(metadata, response)
meraki.exceptions.APIError: organizations, getOrganizationNetworks - 404 Not Found, {'errors': ['API access is disabled for this organization. To make API requests for this organization you must first enable API access.']}

We can also verify the connectivity using below CURL Command:

CURL:

curl -L --request GET \
--url https://api.meraki.com/api/v1/organizations \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'X-Cisco-Meraki-API-Key: [API Key]'

Resolution

API should have Full Admin (Read-only) permissions for the whole organisation.

Reference Example from Meraki side,

Related Links

How to Enable the API Access in Cisco Meraki

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release