Knowledge Management

Priority and editing of local.meta/default.meta

fatsug
Contributor

Hello everyone

Two parter. First of all, am I correct in assuming that

/appname/metadata/local.meta

takes precedence over

/appname/metadata/local.meta

The reason for this question is that while applying changes in a SH cluster from a deployer, changes made to default.meta in an app has no effect and changes in local.meta are retained.

Second, what is the best praxis for editing the local.meta file? I think I, at least, need to completely remove the read/write permissions so it falls back on the default.meta file

[]
access = read : [  ], write : [  ]
export = none
version = x.x.x.x
modtime = tttttttttt.tttttttt

Otherwise any future edits made and rolled out will not take effect as there is a local.meta file. Though I was hoping that I could just delete the entire local.meta file?

To be clear, the actual question, can I

    a) delete the entire local.meta file or do I have to

    b) edit out the desired section in the local.meta file?

I know I can edit access to alerts/dashboards etc via the GUI though I'd like to edit for everything in the app in one single move from the CLI.

All the best

// f

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You are correct; local.meta trumps default.meta for a given app.  To get the default.meta to take effect again, the local.meta stanza or file must be removed.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

And just to make sure, there is no problem just removing the file?

I assume that you first check for any local changes you want to remain, but otherwise you can just delete the file and move on?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No problem just removing .meta files.

Correct.

---
If this reply helps you, Karma would be appreciated.

fatsug
Contributor

Schweet, thanx!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...