How to remove orphaned stanza from local.meta in a custom app which causing permission conflicts when trying to update permissions

Applicability

Description

If a KO (e.g. a lookup) has its permissions changed via the UI, it will generate a stanza in the local.meta file in the custom app. If the custom app is updated to remove this KO, the stanza in the local.meta will remain since the change was not made through the UI. This orphaned stanza causes an error (Cannot overwrite existing app object) when attempting to recreate or share a KO with the same name.

The error occurs when sharing (e.g. changing the permissions to global) because Splunk will try to copy the stanza from the local context to the global context, but finds that one already exists (Cannot overwrite existing app object).

Investigation

1. Confirm the presence of the orphaned stanza in the global app context local.meta file at apps/APP_NAME/metadata/local.meta.
2. Verify that a Knowledge Object (KO) with the same name exists in the private user context at users/USERNAME/APP_NAME/local/props.conf and users/USERNAME/APP_NAME/metadata/local.meta.
3. Attempt to change the permissions of the user's KO to global and observe the permission conflict error (Cannot overwrite existing app object) caused by the orphaned stanza.

Resolution

1. Delete the user's private version of the Knowledge Object (KO).
2. Upload a new version of the custom app that adds the KO, including the permissions in default.meta and configurations in props.conf. This action will "un-orphan" the local.meta stanza and resolve the permission conflict.
3. At this point, the KO can be edited or shared as desired.