A fellow Splunk administrator is reviewing an app that has been downloaded from splunkbase and deployed in an organization. The admin has e-mailed the following configuration snippet with a brief note that says `fix the permissions`.
In what configuration file should the snippet be placed?
[]
access = read : [ * ], write : [ admin ]
export - system
(Assume that $APP_HOME refers to the path that the app is installed, e.g. $SPLUNK_HOME/etc/apps/
The given configuration snippet is related to setting file permissions and exporting settings at a system level in a Splunk app. This kind of configuration is handled in the metadata directory, specifically in the local.meta file within the app's directory. The correct file to place the snippet is $APP_HOME/metadata/local.meta as this is where you define permissions and export settings for the app.
Answer is C - $APP_HOME/metadata/local.meta. I've just checked on my SPlunk instance
C. $APP_HOME/metadata/local.meta
Look into on my Splunk instance and didn't find anything besides the /etc/system directory. I go with the given answer. Letter D.
Fixing my previous answer, the correct answer is C. Agree with @New_user.