Update @ITWhisperer  you got me in the right direction. I was able to find the following article: https://docs.splunk.com/Documentation/ITSI/4.19.0/Configure/CustomRoles and was able to resolve the issue by including the new custom role under KV store collections: itsi_services itsi_teams By using the following the steps: Step 4: Assign the role KV store collection level access The SA-ITOA file includes default entries in metadata/default.meta that determine access to KV store collections for ITSI roles. For a list of default permissions to KV store collections for ITSI roles, see KV store collection permissions in ITSI. By default, only the itoa_admin role has read/write/delete access to all ITSI KV store collections. Set permissions to KV store collections in Splunk Web In Splunk Web, go to Settings > All configurations. Set the App to IT Service Intelligence (itsi). Set the Owner to Any. Make sure Visible in the App is selected. Filter by collections-conf to only display KV store collections. For a specific view, click Permissions in the Sharing column. Check the boxes to grant read and write permissions to the various collections for ITSI roles. Click Save. This action updates KV store access permissions for the specific ITSI roles in $SPLUNK_HOME/etc/apps/SA-ITOA/metadata/local.meta. Set permissions to KV store collections from the command line Create a local.meta file in the SA-ITOA/metadata/ directory. cd $SPLUNK_HOME/etc/apps/SA-ITOA/metadata cp default.meta local.meta Edit SA-ITOA/metadata/local.meta . Set access for specific roles in local.meta. For example: [collections/itsi_services] access = read : [ itoa_admin, itoa_analyst, itoa_user ], write: [ itoa_admin ] ... View more