This is still an open issue as of Splunk 6.5.0 http://docs.splunk.com/Documentation/Splunk/6.5.0/ReleaseNotes/KnownIssues
As a workaround you can run the command below to restore the inheritance. It leaves the explicit permission assignments that splunkd does as part of the deployment process in place so it should be low risk. I have been using a this command at the C:\Program Files\Splunk level so it covers other locations, like the log directories and frozen index directories, as well. It can take a while to run if you include the whole Splunk directory so adapt to suit your needs.
icacls.exe "C:\Program Files\Splunk\etc\apps" /inheritance:e /T
You can use the /reset option of the icacls to restore the inheritance and remove the explicit permission assignments but I haven't tested the impact of that.
This is the same issue as https://answers.splunk.com/answers/250970/why-does-splunkd-change-ntfs-permissions.html
... View more