BundleArchiver - Filtered nothing out of local.meta, but size still changed

[raziasaduddin]

I keep getting this message every few minutes for the a specific app that I haven't changed in months.

"WARN BundleArchiver - Filtered nothing out of Splunk\etc\apps\myapp\metadata\local.meta, but size still changed: original_size=122, filtered_size=117, cosmetic_bytes=0"

How can I get rid of this error?

[ww9rivers]

I've been getting the same WARN messages, although on a Linux search head.

In my case, I found that the "local.meta" was a Windows text file (with CR+LF at the end of each line). I did a "cat local.meta" on the Linux host's command line and then copy-n-pasted the contents to a new local.meta file.

That stopped splunkd from complaining in the splunkd.log file.

I figured out the file format using "hexdump -c local.meta" on the Linux host -- If you see "\r \n" sequences in the output, it's a Windows text file. I guess splunkd expects to see UNIX text file for "local.meta".

In my case, the "local.meta" file is distributed by a deployment server, which is Windows. Maybe "local.meta" should not have been deployed that way at all?

[chans28]

In my case it was manually deployed to the HF and I couldn't see any windows carriage returns or line feeds but I still ran dos2unix on my local.meta anyways and restarted the HF and the log entries disappeared. I had to install it first. 

>yum install dos2unix
>dos2unix local.meta

[aelliott]

I'm getting this Warning too many times within my log files:
WARN BundleArchiver -
Filtered nothing out of C:\Program Files\Splunk\etc\apps\maps\metadata\local.meta, but size still changed: original_size=92, filtered_size=84, cosmetic_bytes=1

WARN BundleArchiver -
Filtered nothing out of C:\Program Files\Splunk\etc\apps\sideview_utils\metadata\local.meta, but size still changed: original_size=322, filtered_size=302, cosmetic_bytes=3