Spotlight Indexing Hot DB

Path Finder

I'm not sure if this is the issue or not, but I think that Spotlight is attempting to index the hot_db and the errors are filling up my /var/log/system.log file.

This is the error file I'm seeing in system.log:

Oct  6 16:16:15 hostname.local mds[51]: (/.Spotlight-V100/Store-V2/19A22DF0-5F1D-4B5D-837C-DF34BA911F38)(Error) IndexPath in oid_t _oidParentForOid(SIPersistentIDStoreRef, uint64_t):stat succeeded, getattrlist returned error  2 for 18980198 (/.vol/16777218/18980198 = /Applications/splunk/var/lib/splunk/defaultdb/db/hot_v1_27/1381090574-1381090574-16724175646614228905.pre-tsidx)

The "returned error 2 for #" are changing as they continue.

When I start Splunk, it says that there were problems with the configuration file, do I want to continue. If I select "Yes", Splunk starts as normal, but I see the above errors. If I select "No", it doesn't start and tells me that there were Parsing Errors in the "configuration file"...I don't think its related, but it could be some context?

Checking configuration... Error while parsing '/Applications/splunk/etc/apps/sentiment/default/data/ui/views/home.xml':
 no element found: line 3, column 0

OS: Mac OS X (Lion)
Splunk Version: 6.0

Any help or suggestions would be appreciated.

Tags (2)
0 Karma


It is very unlikely these are related.

Yo dawg, I heard you like to index things. So I Spotlight-indexed your Splunk buckets so you can have things indexed while you have things indexed.

According to this -- -- the OS X getattrlist system call can return an ENOENT which (best I can tell) is errno=2 on OS X. Splunk is probably deleting or renaming these hot bucket files before spotlight can fully process them. Letting Spotlight attempt to index Splunk's bucket files should not cause any specific problems other than these errors - but it will cause a lot of needless I/O. It may make things more palatable system-resource-wise to disable Spotlight indexing of $SPLUNK_HOME/var/lib/splunk. More info at

The startup error is not related to the above at all. It almost reads like the sentiment app may have Splunk 6.0 compatibility problems? If you uninstall the sentiment app do these errors go away?

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...