Why am I getting splunkd.log warning "Could not parse mtime for status.csv in search...coercing to time 0"?

[jkloda]

Why am I getting the following warning in splunkd.log

WARN  JobsFeed - Could not parse mtime for status.csv in search admin__nobody_cG9zX3N0YXRz__RMD5c80122141c03a80b_at_1469631569_112_77DB9C6B-348B-46B5-937E-796BB9E42D1B, coercing to time 0.

[Masa · Accepted solution]

This warning itself cannot tell if you have a real issue or not. Basically, search job status feature checks search job status including modification time of the status.csv in a search dispatch directory. There is a chance status.csv file does not have modification time when it is checked. So, in such case, this message shouldn't be WARN log level.

As far as I know, Splunk dev. team is trying to avoid this confusing warning message and improve message more user-friendly in a future release. There is no ETA or fixed release version yet at this point.