topic Re: Getting a cannot find viewstate when disabling alerts in Alerting

Getting a cannot find viewstate when disabling alerts

lanilim16 — Thu, 02 Jul 2015 18:57:33 GMT

I'm a admin user and when I try to disable any alert

I get an error similar to the one blelow
In handler 'savedsearch': Cannot find viewstate with vsid="gle4xmxd"

Re: Getting a cannot find viewstate when disabling alerts

martin_mueller — Thu, 02 Jul 2015 22:44:51 GMT

Sounds like a broken link from times gone by... go to that savedsearches.conf and remove the line vsid=gle4xmxd from that saved search's stanza.

Re: Getting a cannot find viewstate when disabling alerts

lanilim16 — Fri, 03 Jul 2015 14:22:29 GMT

I already removed this from savedsearches.conf beforehand and still get the same error, am I supposed to restart the app for this to take effect? Further to this all alerts are actually resulting to this error message, so if I remove this, will there be any impact?

Re: Getting a cannot find viewstate when disabling alerts

martin_mueller — Sat, 04 Jul 2015 00:17:28 GMT

After editing .conf files manually you will need to either restart splunk or hit http://splunk_host:port/debug/refresh?entity=saved/search to tell splunk about the changed file.

There will be no impact because the viewstate apparently doesn't exist any more. Can't lose something that's already gone.

Re: Getting a cannot find viewstate when disabling alerts

lanilim16 — Mon, 06 Jul 2015 18:16:53 GMT

awesome thanks, this actually worked the URL is http://splunk_host:port/debug/refresh?entity=admin/savedsearch to do a refresh without restart