For a statistical solution with Splunk we make use of multiple datamodels which have different Splunk version numbers connected though the *.meta files.
Documentation is not clear on what the exact purpose of this version number is.
\Splunk\common\metadata\default.meta app contents:
Field datamodels statistical and user_upload:
version = 6.5.0
Field datamodel internal_statistics:
version = 6.6.3
Questions:
- Why is this field not updated to 6.6.3 with Splunk upgrade?
- Are the data models with version 6.6.3 still working for Splunk 6.5.0 still working?
My take on the versioning is that it reflects the splunk version when the folder is initially created. This remains unchanged after upgrading.
You would like to know if this version is used in any way in splunk as you need to know if it needs to be added to your regression testing as a significant factor when you upgrade your Splunk enterprise.
The local.meta is used in two major senses
or
So if any check is to be made for these local.meta files in your regression suite it is that under no circumstances are these files edited manually.
My take on the versioning is that it reflects the splunk version when the folder is initially created. This remains unchanged after upgrading.
You would like to know if this version is used in any way in splunk as you need to know if it needs to be added to your regression testing as a significant factor when you upgrade your Splunk enterprise.
The local.meta is used in two major senses
or
So if any check is to be made for these local.meta files in your regression suite it is that under no circumstances are these files edited manually.