Knowledge Management

Priority and editing of local.meta/default.meta

fatsug
Contributor

Hello everyone

Two parter. First of all, am I correct in assuming that

/appname/metadata/local.meta

takes precedence over

/appname/metadata/local.meta

The reason for this question is that while applying changes in a SH cluster from a deployer, changes made to default.meta in an app has no effect and changes in local.meta are retained.

Second, what is the best praxis for editing the local.meta file? I think I, at least, need to completely remove the read/write permissions so it falls back on the default.meta file

[]
access = read : [  ], write : [  ]
export = none
version = x.x.x.x
modtime = tttttttttt.tttttttt

Otherwise any future edits made and rolled out will not take effect as there is a local.meta file. Though I was hoping that I could just delete the entire local.meta file?

To be clear, the actual question, can I

    a) delete the entire local.meta file or do I have to

    b) edit out the desired section in the local.meta file?

I know I can edit access to alerts/dashboards etc via the GUI though I'd like to edit for everything in the app in one single move from the CLI.

All the best

// f

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

And just to make sure, there is no problem just removing the file?

I assume that you first check for any local changes you want to remain, but otherwise you can just delete the file and move on?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No problem just removing .meta files.

Correct.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

Schweet, thanx!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...