In the file $SPLUNK_HOME/etc/apps/TA-aws_guardduty/metadata/default.meta
there are []
and [views]
stanzas.
The [views]
stanza is causing issues with permissions on the dashboards. When you add role permission to the app on the webgui the changes do not effect the dashboards as the []
stanza is what gets updated in the local.meta
file but the [views]
stanza in the default.meta
file takes precedence for the dashboard.
The [views]
stanza can be added to the local.meta
files manually, but then permissions are not easily managed as using the webgui. If the [views]
stanza is commented out in the default.meta
file then permissions set in the webgui propagate to the dashboard.
What is the reasoning to having the [views]
stanza in the default.meta
file?
I don't see it in other apps or the system default.meta
I'm afraid that if the app gets updated, it will overwrite our changes to the default.meta
file