Deployment Architecture

Is metadata/local.meta deployed by the shc deployer?

taldavita
Explorer

Made changes to search/metadata/local.meta that need deployed to search heads.

search/local/app.conf contains
[shclustering]
deployer_push_mode = local_only

When I stage/send from the shc deployer,  after a rolling restart on the  sh captain search/metadata/local.meta remains the same as before the push.

Does the SHC deploy metadata/local.meta?

Splunk Enterprise 8.2.3 running on Redhat Linux. 8 Node Search Head Cluster. Permission changes made to 

From:
[]
access = read : [ * ], write : [ admin, power ]
export = system
version = 8.2.3.2
modtime = 1666399466.315512000

To:
[]
access = read : [ admin, number_of_roles_here, user, user_ad_user ], write : [ admin, power ]
owner = admin
export = none
version = 8.2.3.2
modtime = 1666381189.171483000

Labels (2)
0 Karma

EH
Explorer

Did you even get an answer to this? I've found that the local.meta is only send to the Captain and should sync to the members. Which does not happen for me. Seems that the replication for local.meta is not in the /default/system.conf. Wondering is adding the stanza to the local/system.conf would solve the isssue. But I'm not sure which stanza we would need then.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...