Why does cloning of any alerts or saved searches in an app result in error "Viewstate object not found..."?

[helenashton]

Cloning of any alerts/saved searches in an app are causing the following error (Splunk search head v 6.2):

Encountered the following error while trying to clone: [HTTP 404] Viewstate object not found; view=* viewstate=33333333

I can fix this for an individual case by removing the vsid (as suggested elsewhere), however, it is not practical to do this for everything in an app.

I have checked this app against others (which don't have this error) and the permissions are the same.

Any ideas?

[somesoni2]

The clone problem exists because the Viewstate ID (vsid) is not present in the viewstates.conf. You can either add an remove viewstate for the object or copy the source state by doing the following:

viewstates.conf
...
[*:33333333]
...

[helenashton]

thanks - additional understanding 🙂
so I can either remove the vsid from savedsearches.conf, or add it into viewstates.conf

useful, but still something I need to do for each vsid.

Any idea for an app wide fix? Or why this would have happened in the first place?