Dashboards & Visualizations

Error while modifying Splunk for BlueCoat dashboard search

pillowhead
Explorer

I am trying to modify the 'Overview-Top Clients by IP' search on the dashboard overview page in Splunk for BlueCoat. I go to the 'Apps Manager\splunkforbluecoat-View Configurations\Overview - Top Clients by IP' and then I modify the search. When I click on save I get the following error:

Encountered the following error while trying to update: In handler 'savedsearch': Cannot find viewstate with vsid="fx3mgenj"

The search string works when used from the search line in Splunk for BlueCoat.

Tags (1)
0 Karma
1 Solution

bwooden
Splunk Employee
Splunk Employee

I was able to re-produce using Splunk 4.1 (build 77833).

I created the below file (and restarted Splunk) as a work-around.

$SPLUNK_HOME/etc/apps/SplunkforBlueCoat/local/viewstates.conf
[*:fx3mgenj]

View solution in original post

0 Karma

rotten
Communicator

I'm getting this with one of our saved searches in a custom app as well. (Splunk 4.1.4) I don't have the option to so easily restart Splunk. I saved the search again with a new name and was able to edit that. Then I deleted the original search.

bwooden
Splunk Employee
Splunk Employee

I was able to re-produce using Splunk 4.1 (build 77833).

I created the below file (and restarted Splunk) as a work-around.

$SPLUNK_HOME/etc/apps/SplunkforBlueCoat/local/viewstates.conf
[*:fx3mgenj]

0 Karma

pillowhead
Explorer

This solved my issue. Thank you!

0 Karma

sri_ratp
Engager

this works. thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...