Deployment Architecture

Is metadata/local.meta deployed by the shc deployer?

taldavita
Explorer

Made changes to search/metadata/local.meta that need deployed to search heads.

search/local/app.conf contains
[shclustering]
deployer_push_mode = local_only

When I stage/send from the shc deployer,  after a rolling restart on the  sh captain search/metadata/local.meta remains the same as before the push.

Does the SHC deploy metadata/local.meta?

Splunk Enterprise 8.2.3 running on Redhat Linux. 8 Node Search Head Cluster. Permission changes made to 

From:
[]
access = read : [ * ], write : [ admin, power ]
export = system
version = 8.2.3.2
modtime = 1666399466.315512000

To:
[]
access = read : [ admin, number_of_roles_here, user, user_ad_user ], write : [ admin, power ]
owner = admin
export = none
version = 8.2.3.2
modtime = 1666381189.171483000

Labels (2)
0 Karma

EH
Explorer

Did you even get an answer to this? I've found that the local.meta is only send to the Captain and should sync to the members. Which does not happen for me. Seems that the replication for local.meta is not in the /default/system.conf. Wondering is adding the stanza to the local/system.conf would solve the isssue. But I'm not sure which stanza we would need then.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...