Reporting

Viewstate error messages when trying to save search

Influencer

Every time I try to save a search I get:

Cannot find viewstate with vsid="gzklzlwi"

The actual vsid changes every time. I've searched through every .conf file on the search heads and the provided vsids doen't exist anywhere.

# find /opt/splunk/etc -name \*.conf -exec grep -H -i gzklzlwi {} \;    
# find /opt/content/etc -name \*.conf -exec grep -H -i gzklzlwi {} \;

The search heads are pooled. The /opt/content path is the shared filesystem. I've run the find commands above on both search heads with no results.

Halp?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Following up on @mschroeder's comments:

You need to have the ability to modify viewstates in any app where you want to save searches, even private saved searches. This is why apps like the search app (for example) make viewstates world-writable.

The relevant bit of configuration goes into $SPLUNK_HOME/etc/apps/your-app/metadata/default.meta. For example, in $SPLUNK_HOME/etc/apps/search/metadata/default.meta:

### VIEWSTATES: even normal users should be able to create shared viewstates

[viewstates]
access = read : [ * ], write : [ * ]
export = system

View solution in original post

New Member

i'm getting the error when trying to save/edit an imported alert on splunk 6.5.1

Getting the error below:
Cannot find viewstate with vsid="is5g16jw"

[viewstates]
access = read : [ * ], write : [ * ]
export = system

Is there a fix or workaround for this?

0 Karma

Champion

Same problem still happening in 6.0.5. We were told upgrading from our previous version 5.x would resolve it. We are using SH_POOL.

0 Karma

Champion

This is in SH_POOL/etc/apps/search/local/savedsearches.conf

0 Karma

Splunk Employee
Splunk Employee

Are you hitting this error for saved searches in a custom app or in an app that ships as part of splunk?

If the former, you probably have to change your app's permissions, per my answer (see above).

0 Karma

Splunk Employee
Splunk Employee

Following up on @mschroeder's comments:

You need to have the ability to modify viewstates in any app where you want to save searches, even private saved searches. This is why apps like the search app (for example) make viewstates world-writable.

The relevant bit of configuration goes into $SPLUNK_HOME/etc/apps/your-app/metadata/default.meta. For example, in $SPLUNK_HOME/etc/apps/search/metadata/default.meta:

### VIEWSTATES: even normal users should be able to create shared viewstates

[viewstates]
access = read : [ * ], write : [ * ]
export = system

View solution in original post

Influencer

Thanks, ewoo. Good stuff!

0 Karma

Explorer

I encounter the same problem (Splunk 5.0.1). Was there a solution?

Explorer

All I see is stuff like
ERROR SavedSearchAdminHandler - Cannot find viewstate with vsid="hdon9b1k"
in splunkd.log.

But I think I found the source of the issue. I did not have write permissions on the App. I think those should not be required, but it seems they are.

0 Karma

Splunk Employee
Splunk Employee

Do you see any errors in splunkd.log or splunkd_access.log related to the "missing" viewstate? Perhaps there is some indication of a failure to create that viewstate.

0 Karma

Splunk Employee
Splunk Employee

Can you please file a case with our support team and send in a splunk diag of the search head where the problem happens?

0 Karma

Influencer

Sadly, the ticket went nowhere. But through trial and error I found the same solution as mschroeder, and echoed by ewoo below.

0 Karma