Implementing Splunk 7, Third Edition - Third Edition

Metadata

Object permissions are stored in files located at $SPLUNK_HOME/etc/apps/$appname/metadata/. The two possible files are default.meta and local.meta.

These files have certain properties:

• They are only relevant to the resources in the app where they are contained
• They do merge, with entries in local.meta taking precedence
• They are generally controlled by the admin interface
• They can contain rules that affect all configurations of a particular type, but this entry must be made manually

In the absence of these files (not all apps will have this folder), resources are limited to the current app.

Let's look at default.meta for is_app_one, as created by Splunk:

# Application-level permissions [] access = read : [ * ], write : [ admin, ...