A fellow Splunk administrator is reviewing an app that has been downloaded from splunkbase and deployed in an organization. The admin has e-mailed…

The provided configuration snippet, access = read : [ ], write : [ admin ] export - system, is used to define permissions and sharing for Splunk knowledge objects. This type of configuration belongs in a metadata file (.meta). For an administrator to apply a persistent, local change to an app's knowledge objects, the configuration should be placed in the local.meta file within that app's metadata directory. This ensures the changes are not overwritten during app upgrades. The path $APPHOME/metadata/local.meta is the standard, correct location for this purpose.

A. $APPHOME/default/app.conf

This file defines the properties of the application itself, such as its version and label, not the permissions of the knowledge objects within it.

B. $APPHOME/local/default.meta

This path is incorrect. Metadata files (.meta) are located in a metadata directory, not directly within the local directory of an app.

D. $SPLUNKHOME/etc/system/local/server.conf

This file is used for system-wide server settings, such as networking and indexing configurations, not for managing app-specific knowledge object permissions.

---

1. Splunk Enterprise Documentation

Admin Manual

"Manage knowledge object permissions": This section explicitly states that permissions are set in .meta files. It provides the correct file path: "Permissions for an object are stored in a file called .meta in the metadata directory for that app. For example

$SPLUNKHOME/etc/apps//metadata/local.meta." This directly supports answer C.

2. Splunk Enterprise Documentation

Admin Manual

"Configuration file precedence": This document explains that administrators should make changes in local directories to override default settings and ensure that changes persist after upgrades. This reinforces the use of local.meta over default.meta for administrative changes.

3. Splunk Enterprise Documentation

Admin Manual

"app.conf": The specification for app.conf confirms its role is to define app properties and UI behavior

with no stanzas for knowledge object access control. This refutes option A.

4. Splunk Enterprise Documentation

Admin Manual

"server.conf": The specification for server.conf details its use for global server settings. It contains no attributes or stanzas related to the access or export settings for knowledge objects. This refutes option D.