Why am I getting error "Cannot find viewstate with vsid="XXXXXXXXX""? while saving searches?

[Kaushikkatta03]

I'm trying to save the search, but getting this error:

Saved Search - Cisco -
Error - Encountered the following error while trying to update: In handler 'savedsearch': Cannot find viewstate with vsid="XXXXXXXXX"

[scruse]

Do you see any errors in splunkd.log or splunkd_access.log related to the "missing" viewstate? Perhaps there is some indication of a failure to create that viewstate.

Additionally, you need to have the ability to modify viewstates in any app where you want to save searches, even private saved searches. (IE: Write permissions) This is why apps like the search app (for example) make viewstates world-writable.

The relevant bit of configuration goes into $SPLUNK_HOME/etc/apps/your-app/metadata/default.meta. For example, in $SPLUNK_HOME/etc/apps/search/metadata/default.meta:

 ### VIEWSTATES: even normal users should be able to create shared viewstates
 [viewstates]
 access = read : [ * ], write : [ * ]
 export = system