Why am I getting the following warning in splunkd.log
WARN JobsFeed - Could not parse mtime for status.csv in search admin__nobody_cG9zX3N0YXRz__RMD5c80122141c03a80b_at_1469631569_112_77DB9C6B-348B-46B5-937E-796BB9E42D1B, coercing to time 0.
This warning itself cannot tell if you have a real issue or not. Basically, search job status feature checks search job status including modification time of the status.csv in a search dispatch directory. There is a chance status.csv file does not have modification time when it is checked. So, in such case, this message shouldn't be WARN log level.
As far as I know, Splunk dev. team is trying to avoid this confusing warning message and improve message more user-friendly in a future release. There is no ETA or fixed release version yet at this point.
This warning itself cannot tell if you have a real issue or not. Basically, search job status feature checks search job status including modification time of the status.csv in a search dispatch directory. There is a chance status.csv file does not have modification time when it is checked. So, in such case, this message shouldn't be WARN log level.
As far as I know, Splunk dev. team is trying to avoid this confusing warning message and improve message more user-friendly in a future release. There is no ETA or fixed release version yet at this point.