Alerting

Why am I seeing this error in my local.meta file app inspect?

altink
Builder

Hi

I have this error in my AppInspect Report:

Do not supply a local.meta file- put all settings in default.meta. File: metadata/local.meta.

In my app, under folder metadata, I can see the two files:
local.meta
default.meta

Which place of default.meta do I put the local.meta content, start or end ?
Can it be deleted?
Is it recreated during app work-update?
Is there a documentation describing this?

best regards
Altin

Labels (1)
Tags (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

It doesn’t really matter.

you can just copy content of local.meta and paste at the end of default.meta file.

you are running Splunk in linux.

just do below:

cat local.meta >> default.meta

rm -rf local.meta

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

you are not supposed to keep anything in local directory or local.meta in metadata folder/directory.

you can copy all your local.meta to default.meta  So the error will go.

————————————
If this helps, give a like below.

altink
Builder

thank you

but how do I copy?
where do I put the local.meta content, which place of default.meta - start or end ?
or matters not?


regards
Altin

0 Karma

thambisetty
SplunkTrust
SplunkTrust

It doesn’t really matter.

you can just copy content of local.meta and paste at the end of default.meta file.

you are running Splunk in linux.

just do below:

cat local.meta >> default.meta

rm -rf local.meta

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...