Knowledge Management

Priority and editing of local.meta/default.meta

fatsug
Contributor

Hello everyone

Two parter. First of all, am I correct in assuming that

/appname/metadata/local.meta

takes precedence over

/appname/metadata/local.meta

The reason for this question is that while applying changes in a SH cluster from a deployer, changes made to default.meta in an app has no effect and changes in local.meta are retained.

Second, what is the best praxis for editing the local.meta file? I think I, at least, need to completely remove the read/write permissions so it falls back on the default.meta file

[]
access = read : [  ], write : [  ]
export = none
version = x.x.x.x
modtime = tttttttttt.tttttttt

Otherwise any future edits made and rolled out will not take effect as there is a local.meta file. Though I was hoping that I could just delete the entire local.meta file?

To be clear, the actual question, can I

    a) delete the entire local.meta file or do I have to

    b) edit out the desired section in the local.meta file?

I know I can edit access to alerts/dashboards etc via the GUI though I'd like to edit for everything in the app in one single move from the CLI.

All the best

// f

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

And just to make sure, there is no problem just removing the file?

I assume that you first check for any local changes you want to remain, but otherwise you can just delete the file and move on?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No problem just removing .meta files.

Correct.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

Schweet, thanx!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...