topic metadata/local.meta question in Splunk Enterprise Security

metadata/local.meta question

d_lim — Wed, 09 Sep 2020 09:32:10 GMT

Hello, so I was looking at my metadata/local.meta and it is only the following 4 lines:

[savedsearches/mysavedsearch]
owner = myaccount
version = <something>
modtime = <something>

From the splunk web it shows that the savedsearch is of "App" sharing.

My question is, shouldn't there be a setting there as: export = none

Trying to find out how the savedsearch was created, what causes the creation of savedsearch to not have the export configurations?

Re: metadata/local.meta question

thambisetty — Wed, 09 Sep 2020 10:31:45 GMT

you are right, as per the docs, it should be there export=none.

I see lookup shared global but there is no export=system in test machine.

I did couple of testings with savedsearch and I can see export=none when I change sharing from private to App.

Re: metadata/local.meta question

isoutamo — Wed, 09 Sep 2020 16:29:56 GMT

if you have write access to app you can save your saved searches under .../etc/apps/<app name>/local this implicitly means that it’s export=none. If you haven’t that access then those are under .../etc/users/<user>/<app>/local. And if you have access to share KOs to global then those are written to that first directory and to local.meta is added export=system.

r. Ismo

Re: metadata/local.meta question

d_lim — Thu, 10 Sep 2020 01:21:18 GMT

Yep, there should be the "export=none/system"

My issue was that there isn't. On the splunk web it shows as "App" sharing however.

I'm trying to figure out why or what causes it to not have the line "export=none/system"