For context, we have a user (and group) named splunk which runs our Splunk instance. The umask for this account is 0002 (u=rwx,g=rwx,o=rx). Observing default file permissions as the splunk user: [splunk@___ ~]$ touch foo && ls foo -l -rw-rw-r-- 1 splunk splunk 0 Sep 29 17:02 foo My assumption was there was some Splunk configuration controlling the file permissions of the lookup csv file, but based on your feedback it sounds like that's not the case. ... View more

Just checked out the code and confirmed the bug. I created an issue to track this as well: https://github.com/splunk/splunk-reskit-powershell/issues/13 ... View more