Splunk report copy permission

[David_M]

I ave a couple of scheduled reports that I SCP off of our splunk enterprise.  Both reports are in /opt/splunk/etc/apps/search/lookups.  One of the reports I setup a while ago and it's permissions look right and I can SCP it (file1.csv).  The new report gives me a permission denied when I try to copy it (file2.csv).

File 1:

-rw-r-----. 1 splunk splunk 306519 Jan 26 05:00 file1.csv

-rw-------. 1 splunk splunk 1177070 Jan 26 03:00 file2.csv

Not sure how to get file2.csv group readable so I can copy it off.

[David_M]

Yep, that got it working.

[richgalloway · Accepted solution]

You may need to adjust the umask setting for the splunk account.