Viewstate error messages when trying to save search

[twinspop]

Every time I try to save a search I get:

Cannot find viewstate with vsid="gzklzlwi"

The actual vsid changes every time. I've searched through every .conf file on the search heads and the provided vsids doen't exist anywhere.

# find /opt/splunk/etc -name \*.conf -exec grep -H -i gzklzlwi {} \;    
# find /opt/content/etc -name \*.conf -exec grep -H -i gzklzlwi {} \;

The search heads are pooled. The /opt/content path is the shared filesystem. I've run the find commands above on both search heads with no results.

Halp?

[vorgraven]

i'm getting the error when trying to save/edit an imported alert on splunk 6.5.1

Getting the error below:
Cannot find viewstate with vsid="is5g16jw"

[viewstates]
access = read : [ * ], write : [ * ]
export = system

Is there a fix or workaround for this?

[the_wolverine]

Same problem still happening in 6.0.5. We were told upgrading from our previous version 5.x would resolve it. We are using SH_POOL.

[the_wolverine]

This is in SH_POOL/etc/apps/search/local/savedsearches.conf

[ewoo]

Are you hitting this error for saved searches in a custom app or in an app that ships as part of splunk?

If the former, you probably have to change your app's permissions, per my answer (see above).

[ewoo · Accepted solution]

Following up on @mschroeder's comments:

You need to have the ability to modify viewstates in any app where you want to save searches, even private saved searches. This is why apps like the search app (for example) make viewstates world-writable.

The relevant bit of configuration goes into $SPLUNK_HOME/etc/apps/your-app/metadata/default.meta. For example, in $SPLUNK_HOME/etc/apps/search/metadata/default.meta:

### VIEWSTATES: even normal users should be able to create shared viewstates

[viewstates]
access = read : [ * ], write : [ * ]
export = system

[twinspop]

Thanks, ewoo. Good stuff!

[mschroeder]

I encounter the same problem (Splunk 5.0.1). Was there a solution?

[mschroeder]

All I see is stuff like
ERROR SavedSearchAdminHandler - Cannot find viewstate with vsid="hdon9b1k"
in splunkd.log.

But I think I found the source of the issue. I did not have write permissions on the App. I think those should not be required, but it seems they are.

[ewoo]

Do you see any errors in splunkd.log or splunkd_access.log related to the "missing" viewstate? Perhaps there is some indication of a failure to create that viewstate.

[Ledion_Bitincka]

Can you please file a case with our support team and send in a splunk diag of the search head where the problem happens?

[twinspop]

Sadly, the ticket went nowhere. But through trial and error I found the same solution as mschroeder, and echoed by ewoo below.