All Apps and Add-ons

What is the logic behind having [views] stanza in default.meta


In the file $SPLUNK_HOME/etc/apps/TA-aws_guardduty/metadata/default.meta there are [] and [views] stanzas.
The [views] stanza is causing issues with permissions on the dashboards. When you add role permission to the app on the webgui the changes do not effect the dashboards as the [] stanza is what gets updated in the local.meta file but the [views] stanza in the default.meta file takes precedence for the dashboard.
The [views] stanza can be added to the local.meta files manually, but then permissions are not easily managed as using the webgui. If the [views] stanza is commented out in the default.meta file then permissions set in the webgui propagate to the dashboard.

What is the reasoning to having the [views] stanza in the default.meta file?
I don't see it in other apps or the system default.meta
I'm afraid that if the app gets updated, it will overwrite our changes to the default.meta file

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...