topic Re: I'm getting the error "Unable to get viewstate information for <insert saved search>" What should I do? in Dashboards & Visualizations

I'm getting the error "Unable to get viewstate information for " What should I do?

hulahoop — Wed, 20 Jan 2010 14:32:49 GMT

How to resolve these viewstate error messages?

"Unable to get viewstate information for Juniper - Top 5 Outbound Deny Hosts for TCP Port 80; formatting may not be correct"

This dashboard uses simple XML and lives in an App created using the Manager. The App contains a savedsearches.conf file and another dashboard which uses advanced XML. Both dashboards call different searches from savedsearches.conf. The dashboard with advanced XML loads just fine (no viewstate errors).

Strangely enough, converting the simple XML dashboard to advanced XML fixed the problem. This can't be the solution. There must be a bug or something missing.

I checked for possible duplicates of the saved search, deleted all related viewstates.conf files, even installed the App in a brand new Splunk instance. I also checked permissions on the dashboard XML files and savedsearches.conf and verified the existence of the local folders as Emma suggested in a recent support case. None of these actions made a difference.

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

gkanapathy — Thu, 28 Jan 2010 16:25:32 GMT

To be honest, I don't know why the error shows up. Possibly it's just because the message is at too high an alert level. You can fix this however by editing the savedsearches.conf file and removing the vsid property on the saved search. This will lose the viewstate properties, but viewstate should be considered transient anyway. (You should explicitly say how you want results to be rendered when you define your dashboard and modules and not rely on viewstate.)

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

hulahoop — Fri, 29 Jan 2010 09:28:28 GMT

Deleting the vsid params and restarting didn't work for me. The dashboards were simple data tables and had no charts. Is there view state associated with data tables?

Juniper - Top 5 Outbound Deny Hosts for TCP Port 443
Top 5 Outbound Deny Hosts for TCP Port 443

Juniper - Top 5 Outbound Deny Hosts for TCP Port 80
Top 5 Outbound Deny Hosts for TCP Port 80

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

gkanapathy — Thu, 11 Feb 2010 22:18:22 GMT

@hulahoop, did you delete the vsid parameter in your own private savedsearches.conf, or only in the app one?

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

hulahoop — Fri, 12 Feb 2010 02:32:45 GMT

Both. I deleted it everywhere it existed.

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

NancyCunningham — Thu, 13 May 2010 02:07:10 GMT

We ran into what sounds like the same issue.

We have a set of dashboards called Snapshots that refer to saved/scheduled searches. These were created inside an application we named Snapshot.

It would be great to have these also show up inside other applications, but when we tried just sharing the searches and dashboards globally and adding the dashboards to the navigation of a second app, then we get the error

"Unable to get viewstate information for DASHBOARD_NAME; formatting may not be correct"

The search runs from scratch, instead of pulling up the results from the last saved search.

Hoping there's a way to get it to use the results.

Thanks, Nancy

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

Simon_Shelston — Fri, 30 Jul 2010 02:52:23 GMT

Seeing this in 4.1.4 -- any fixes?

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

Claw — Sun, 24 Jul 2011 03:06:34 GMT

I built a small app for a customer last week and I am seeing the same behavior. It is a little baffling since the app is so simple.

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

bckq — Sun, 11 Nov 2012 10:01:13 GMT

I'm getting similar warning. "Unable to get viewstate information; formatting may not be correct".
There isn't any information with what search or dashboard is problem so I don't even know on what dashboard should I look for it. ; /

Re: I'm getting the error "Unable to get viewstate information for " What should I do?

DrewO — Wed, 13 Mar 2013 18:33:03 GMT

I too had this problem and removed all vsids from all my savedsearches.conf, but it wouldn't go away. The problem is if you don't restart splunk, the error won't clear. I thought I could just restart splunk web, but nope. Full splunk restart FINALLY cleared it.