topic Re: Viewstate error messages when trying to save search in Reporting

Viewstate error messages when trying to save search

twinspop — Fri, 09 Mar 2012 02:39:10 GMT

Every time I try to save a search I get:

Cannot find viewstate with vsid="gzklzlwi"

The actual vsid changes every time. I've searched through every .conf file on the search heads and the provided vsids doen't exist anywhere.

# find /opt/splunk/etc -name \*.conf -exec grep -H -i gzklzlwi {} \;    
# find /opt/content/etc -name \*.conf -exec grep -H -i gzklzlwi {} \;

The search heads are pooled. The /opt/content path is the shared filesystem. I've run the find commands above on both search heads with no results.

Halp?

Re: Viewstate error messages when trying to save search

Ledion_Bitincka — Sat, 10 Mar 2012 00:19:07 GMT

Can you please file a case with our support team and send in a splunk diag of the search head where the problem happens?

Re: Viewstate error messages when trying to save search

mschroeder — Wed, 27 Feb 2013 15:35:28 GMT

I encounter the same problem (Splunk 5.0.1). Was there a solution?

Re: Viewstate error messages when trying to save search

ewoo — Wed, 27 Feb 2013 18:36:49 GMT

Do you see any errors in splunkd.log or splunkd_access.log related to the "missing" viewstate? Perhaps there is some indication of a failure to create that viewstate.

Re: Viewstate error messages when trying to save search

mschroeder — Thu, 28 Feb 2013 09:56:40 GMT

All I see is stuff like
ERROR SavedSearchAdminHandler - Cannot find viewstate with vsid="hdon9b1k"
in splunkd.log.

But I think I found the source of the issue. I did not have write permissions on the App. I think those should not be required, but it seems they are.

Re: Viewstate error messages when trying to save search

ewoo — Thu, 28 Feb 2013 20:05:58 GMT

Following up on @mschroeder's comments:

You need to have the ability to modify viewstates in any app where you want to save searches, even private saved searches. This is why apps like the search app (for example) make viewstates world-writable.

The relevant bit of configuration goes into $SPLUNK_HOME/etc/apps/your-app/metadata/default.meta. For example, in $SPLUNK_HOME/etc/apps/search/metadata/default.meta:

### VIEWSTATES: even normal users should be able to create shared viewstates

[viewstates]
access = read : [ * ], write : [ * ]
export = system

Re: Viewstate error messages when trying to save search

twinspop — Thu, 28 Feb 2013 22:03:22 GMT

Sadly, the ticket went nowhere. But through trial and error I found the same solution as mschroeder, and echoed by ewoo below.

Re: Viewstate error messages when trying to save search

twinspop — Thu, 28 Feb 2013 22:04:00 GMT

Thanks, ewoo. Good stuff!

Re: Viewstate error messages when trying to save search

the_wolverine — Thu, 14 Aug 2014 20:55:42 GMT

Same problem still happening in 6.0.5. We were told upgrading from our previous version 5.x would resolve it. We are using SH_POOL.

Re: Viewstate error messages when trying to save search

ewoo — Thu, 14 Aug 2014 21:03:24 GMT

Are you hitting this error for saved searches in a custom app or in an app that ships as part of splunk?

If the former, you probably have to change your app's permissions, per my answer (see above).

Re: Viewstate error messages when trying to save search

the_wolverine — Fri, 15 Aug 2014 02:59:04 GMT

This is in SH_POOL/etc/apps/search/local/savedsearches.conf

Re: Viewstate error messages when trying to save search

vorgraven — Mon, 27 Mar 2017 03:49:22 GMT

i'm getting the error when trying to save/edit an imported alert on splunk 6.5.1

Getting the error below:
Cannot find viewstate with vsid="is5g16jw"

[viewstates]
access = read : [ * ], write : [ * ]
export = system

Is there a fix or workaround for this?