Made changes to search/metadata/local.meta that need deployed to search heads.
search/local/app.conf contains
[shclustering]
deployer_push_mode = local_only
When I stage/send from the shc deployer, after a rolling restart on the sh captain search/metadata/local.meta remains the same as before the push.
Does the SHC deploy metadata/local.meta?
Splunk Enterprise 8.2.3 running on Redhat Linux. 8 Node Search Head Cluster. Permission changes made to
From:
[]
access = read : [ * ], write : [ admin, power ]
export = system
version = 8.2.3.2
modtime = 1666399466.315512000
To:
[]
access = read : [ admin, number_of_roles_here, user, user_ad_user ], write : [ admin, power ]
owner = admin
export = none
version = 8.2.3.2
modtime = 1666381189.171483000
Did you even get an answer to this? I've found that the local.meta is only send to the Captain and should sync to the members. Which does not happen for me. Seems that the replication for local.meta is not in the /default/system.conf. Wondering is adding the stanza to the local/system.conf would solve the isssue. But I'm not sure which stanza we would need then.