corespotlightd High CPU on Mac: Find the Trigger First

When corespotlightd stays near the top of Activity Monitor, first check whether the activity follows a particular app or a recent update. A search process using CPU does not by itself prove that the startup disk's Spotlight index needs rebuilding. Deleting its database can discard useful evidence and start more indexing work.

App search and file search are different clues

Core Spotlight lets apps make their content searchable. A document app can submit searchable items even when those items do not correspond to ordinary files in Finder. Apple's app content indexing guide explains that an app maintains those items as its content changes.

The process name is a clue to investigate search activity, not a way to identify the app responsible. If Activity Monitor instead shows mds, mds_stores, or mdworker, use the Spotlight file indexing guide. A busy Core Spotlight service and a missing file in Spotlight are not interchangeable symptoms.

Compare the same workload twice

In Activity Monitor, choose View › All Processes, open CPU, and search for corespotlightd. Note its CPU use, then inspect disk activity too. Keep the workload comparable rather than comparing a busy importing session with a sleeping Mac.

1. Record what changed before the activity started, such as an app update, a new library, or a macOS update.
2. Let an import or sync with visible progress finish before treating it as a loop. No fixed completion time applies to every library.
3. Save work and quit one suspected app normally, then observe the service again. Repeat with the same app reopened if practical.
4. If the behavior returns with that app, check its updates and documented search or indexing settings. Change one thing at a time.

A drop after quitting an app supports a connection; it does not prove a corrupt database. Background work can outlive the app window, so one unchanged reading does not rule the app out either. Avoid force-quitting a list of unrelated services.

Capture evidence when activity persists

Select the process and use More › Sample Process in Activity Monitor. Apple's diagnostics guide describes this as a three-second report. It also documents Spotlight Diagnostics for collecting search-related information.

Keep the macOS version, app version, approximate start time, and the action that reproduces the load with the report. Samples contain stack traces, but a single function name is not a diagnosis. Review reports before sharing them and send them privately to Apple Support or the relevant app developer.

Rebuild only the search that is actually failing

If ordinary Spotlight file results are missing, Apple's rebuild procedure uses Search Privacy or Spotlight Privacy, depending on the macOS version. Add and remove the affected folder or disk as documented. That intentionally triggers indexing again; it is not a general fix for every corespotlightd CPU spike.

If only one app's content is affected, start with that app's documented repair procedure. Do not delete hidden Core Spotlight stores, remove an app's documents, or disable all search as a first response. If the symptom began after a system update, the post-update slowdown guide helps separate indexing from other workloads.

FAQ

Is corespotlightd malware?

The name is associated with macOS search activity, but a process name alone cannot authenticate an executable. If its identity is suspicious, inspect the executable path and signing information rather than trusting the label or deleting files on that basis.

Will clearing caches fix its CPU use?

Not necessarily. Cache cleanup does not identify which app is submitting search content or why work repeats. Correlate the load with an app and capture a sample before choosing a repair.