Getting a cannot find viewstate when disabling alerts

[lanilim16]

I'm a admin user and when I try to disable any alert

I get an error similar to the one blelow
In handler 'savedsearch': Cannot find viewstate with vsid="gle4xmxd"

[martin_mueller · Accepted solution]

Sounds like a broken link from times gone by... go to that savedsearches.conf and remove the line vsid=gle4xmxd from that saved search's stanza.

[martin_mueller]

After editing .conf files manually you will need to either restart splunk or hit http://splunk_host:port/debug/refresh?entity=saved/search to tell splunk about the changed file.

There will be no impact because the viewstate apparently doesn't exist any more. Can't lose something that's already gone.

[lanilim16]

awesome thanks, this actually worked the URL is http://splunk_host:port/debug/refresh?entity=admin/savedsearch to do a refresh without restart

[lanilim16]

I already removed this from savedsearches.conf beforehand and still get the same error, am I supposed to restart the app for this to take effect? Further to this all alerts are actually resulting to this error message, so if I remove this, will there be any impact?