We're running splunk as root, but I did have a look and noticed that there were a number of files owned by uid 508 (but none of the directories), so I figured it was probably good practice to correct those anyway. I did as you suggested and stopped splunk, chowned the dir recursively and started splunk back up.
It doesn't appear to have helped, the same errors are still being logged (but I suspect you didn't expect it to help when running as root anyway).
Thanks for the suggestion.
... View more