In the file $SPLUNK_HOME/etc/apps/TA-aws_guardduty/metadata/default.meta there are [] and [views] stanzas. The [views] stanza is causing issues with permissions on the dashboards. When you add role permission to the app on the webgui the changes do not effect the dashboards as the [] stanza is what gets updated in the local.meta file but the [views] stanza in the default.meta file takes precedence for the dashboard. The [views] stanza can be added to the local.meta files manually, but then permissions are not easily managed as using the webgui. If the [views] stanza is commented out in the default.meta file then permissions set in the webgui propagate to the dashboard. What is the reasoning to having the [views] stanza in the default.meta file? I don't see it in other apps or the system default.meta I'm afraid that if the app gets updated, it will overwrite our changes to the default.meta file ... View more