Archive

Error while modifying Splunk for BlueCoat dashboard search

Explorer

I am trying to modify the 'Overview-Top Clients by IP' search on the dashboard overview page in Splunk for BlueCoat. I go to the 'Apps Manager\splunkforbluecoat-View Configurations\Overview - Top Clients by IP' and then I modify the search. When I click on save I get the following error:

Encountered the following error while trying to update: In handler 'savedsearch': Cannot find viewstate with vsid="fx3mgenj"

The search string works when used from the search line in Splunk for BlueCoat.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

I was able to re-produce using Splunk 4.1 (build 77833).

I created the below file (and restarted Splunk) as a work-around.

$SPLUNK_HOME/etc/apps/SplunkforBlueCoat/local/viewstates.conf
[*:fx3mgenj]

View solution in original post

0 Karma

Communicator

I'm getting this with one of our saved searches in a custom app as well. (Splunk 4.1.4) I don't have the option to so easily restart Splunk. I saved the search again with a new name and was able to edit that. Then I deleted the original search.

Splunk Employee
Splunk Employee

I was able to re-produce using Splunk 4.1 (build 77833).

I created the below file (and restarted Splunk) as a work-around.

$SPLUNK_HOME/etc/apps/SplunkforBlueCoat/local/viewstates.conf
[*:fx3mgenj]

View solution in original post

0 Karma

Explorer

This solved my issue. Thank you!

0 Karma

Engager

this works. thank you

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!