Dashboards & Visualizations

I'm getting the error "Unable to get viewstate information for <insert saved search>" What should I do?

hulahoop
Splunk Employee
Splunk Employee

How to resolve these viewstate error messages?

"Unable to get viewstate information for Juniper - Top 5 Outbound Deny Hosts for TCP Port 80; formatting may not be correct"

This dashboard uses simple XML and lives in an App created using the Manager. The App contains a savedsearches.conf file and another dashboard which uses advanced XML. Both dashboards call different searches from savedsearches.conf. The dashboard with advanced XML loads just fine (no viewstate errors).

Strangely enough, converting the simple XML dashboard to advanced XML fixed the problem. This can't be the solution. There must be a bug or something missing.

I checked for possible duplicates of the saved search, deleted all related viewstates.conf files, even installed the App in a brand new Splunk instance. I also checked permissions on the dashboard XML files and savedsearches.conf and verified the existence of the local folders as Emma suggested in a recent support case. None of these actions made a difference.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

To be honest, I don't know why the error shows up. Possibly it's just because the message is at too high an alert level. You can fix this however by editing the savedsearches.conf file and removing the vsid property on the saved search. This will lose the viewstate properties, but viewstate should be considered transient anyway. (You should explicitly say how you want results to be rendered when you define your dashboard and modules and not rely on viewstate.)

View solution in original post

Claw
Splunk Employee
Splunk Employee

I built a small app for a customer last week and I am seeing the same behavior. It is a little baffling since the app is so simple.

0 Karma

Simon_Shelston
Splunk Employee
Splunk Employee

Seeing this in 4.1.4 -- any fixes?

0 Karma

NancyCunningham
Engager

We ran into what sounds like the same issue.

We have a set of dashboards called Snapshots that refer to saved/scheduled searches. These were created inside an application we named Snapshot.

It would be great to have these also show up inside other applications, but when we tried just sharing the searches and dashboards globally and adding the dashboards to the navigation of a second app, then we get the error

"Unable to get viewstate information for DASHBOARD_NAME; formatting may not be correct"

The search runs from scratch, instead of pulling up the results from the last saved search.

Hoping there's a way to get it to use the results.

Thanks, Nancy

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

To be honest, I don't know why the error shows up. Possibly it's just because the message is at too high an alert level. You can fix this however by editing the savedsearches.conf file and removing the vsid property on the saved search. This will lose the viewstate properties, but viewstate should be considered transient anyway. (You should explicitly say how you want results to be rendered when you define your dashboard and modules and not rely on viewstate.)

DrewO
Splunk Employee
Splunk Employee

I too had this problem and removed all vsids from all my savedsearches.conf, but it wouldn't go away. The problem is if you don't restart splunk, the error won't clear. I thought I could just restart splunk web, but nope. Full splunk restart FINALLY cleared it.

0 Karma

bckq
Path Finder

I'm getting similar warning. "Unable to get viewstate information; formatting may not be correct".
There isn't any information with what search or dashboard is problem so I don't even know on what dashboard should I look for it. ; /

0 Karma

hulahoop
Splunk Employee
Splunk Employee

Both. I deleted it everywhere it existed.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

@hulahoop, did you delete the vsid parameter in your own private savedsearches.conf, or only in the app one?

0 Karma

hulahoop
Splunk Employee
Splunk Employee

Deleting the vsid params and restarting didn't work for me. The dashboards were simple data tables and had no charts. Is there view state associated with data tables?



Juniper - Top 5 Outbound Deny Hosts for TCP Port 443
Top 5 Outbound Deny Hosts for TCP Port 443


Juniper - Top 5 Outbound Deny Hosts for TCP Port 80
Top 5 Outbound Deny Hosts for TCP Port 80

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...