Which files within an app contain permissions information? (Select all that apply.)

In Splunk, permissions for knowledge objects (such as reports, dashboards, and lookups) within an application are defined in metadata files. The metadata/default.meta file contains the baseline, default permissions that are shipped with the app. When a user modifies these permissions through the Splunk Web UI, the changes are saved to the metadata/local.meta file. The settings in local.meta take precedence over those in default.meta, allowing for customized access control without altering the app's original files.

A. local/metadata.conf: This is not a standard Splunk file or location for storing permissions. Permissions are managed through .meta files, not a metadata.conf file.

C. default/metadata.conf: This is not a standard Splunk file for defining permissions. The correct file for default permissions is metadata/default.meta.

1. Splunk Enterprise Admin Manual

"Manage knowledge object permissions": This document explicitly states

"Splunk software stores knowledge object permissions in .meta files. These files are located in the metadata directory of the app in which the knowledge object is stored... The default.meta file stores the default permissions for an app's knowledge objects. The local.meta file stores permissions for an app's knowledge objects that have been set in Splunk Web." (Reference: Splunk Enterprise 9.x Documentation

Admin Manual

Chapter: "Users and roles"

Section: "Manage knowledge object permissions").

2. Splunk Enterprise Admin Manual

"App architecture and object ownership": This section details the directory structure of a Splunk app and clarifies the role of the metadata directory. It confirms that permissions are set at the object level and stored in .meta files within the metadata directory

with local overriding default. (Reference: Splunk Enterprise 9.x Documentation

Admin Manual

Chapter: "Manage apps"

Section: "App architecture and object ownership").