https://community.splunk.com/t5/Splunk-Search/Why-did-the-lookup-file-not-move-despite-changing-its-read-perms/m-p/296850#M89544 <P>I have noticed this as well, actually! I am not sure why it does that, exactly, but my best suggestion would be to submit a ticket to Splunk. That's what I did <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Maybe it'll be fixed in a new release. </P> Thu, 29 Mar 2018 11:42:40 GMT cmerriman 2018-03-29T11:42:40Z https://community.splunk.com/t5/Splunk-Search/Why-did-the-lookup-file-not-move-despite-changing-its-read-perms/m-p/296849#M89543 <P>I changed the permissions on a lookup file from the UI via Manage Apps - &gt; Search and Reporting -&gt; View Objects -&gt; Read access to everyone on the lookup object. However, on my search head the lookup file is still under $SPLUNK_HOME/etc/users//search/lookups and not under $SPLUNK_HOME/etc/apps/search/lookups/. The read access has been given on app level but at the backend, the file still remains in the user directory. rendering it inaccessible. Is this a bug with Splunk?</P> Tue, 29 Sep 2020 18:44:04 GMT https://community.splunk.com/t5/Splunk-Search/Why-did-the-lookup-file-not-move-despite-changing-its-read-perms/m-p/296849#M89543 sarahafrin 2020-09-29T18:44:04Z https://community.splunk.com/t5/Splunk-Search/Why-did-the-lookup-file-not-move-despite-changing-its-read-perms/m-p/296850#M89544 <P>I have noticed this as well, actually! I am not sure why it does that, exactly, but my best suggestion would be to submit a ticket to Splunk. That's what I did <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Maybe it'll be fixed in a new release. </P> Thu, 29 Mar 2018 11:42:40 GMT https://community.splunk.com/t5/Splunk-Search/Why-did-the-lookup-file-not-move-despite-changing-its-read-perms/m-p/296850#M89544 cmerriman 2018-03-29T11:42:40Z