Error while modifying Splunk for BlueCoat dashboard search

[pillowhead]

I am trying to modify the 'Overview-Top Clients by IP' search on the dashboard overview page in Splunk for BlueCoat. I go to the 'Apps Manager\splunkforbluecoat-View Configurations\Overview - Top Clients by IP' and then I modify the search. When I click on save I get the following error:

Encountered the following error while trying to update: In handler 'savedsearch': Cannot find viewstate with vsid="fx3mgenj"

The search string works when used from the search line in Splunk for BlueCoat.

[rotten]

I'm getting this with one of our saved searches in a custom app as well. (Splunk 4.1.4) I don't have the option to so easily restart Splunk. I saved the search again with a new name and was able to edit that. Then I deleted the original search.

[bwooden · Accepted solution]

I was able to re-produce using Splunk 4.1 (build 77833).

I created the below file (and restarted Splunk) as a work-around.

$SPLUNK_HOME/etc/apps/SplunkforBlueCoat/local/viewstates.conf
[*:fx3mgenj]

[pillowhead]

This solved my issue. Thank you!

[sri_ratp]

this works. thank you