You might want to look under which user splunkd is running and how this users privileges match for the directories / files of those apps that do not behave well. In Linux you could start with: ps -Af | grep splunkd | grep -v grep and then look who can do what with the all apps main directories: ls -la $SPLUNK_HOME$/etc/apps or drill it down to a specific file: find $SPLUNK_HOME$/etc/apps/*/*/savedsearches.conf -exec ls -la {} \; Cheerz - B Edit Maybe this helps: http://answers.splunk.com/answering/222327/view.html ... View more