Sounds like a broken link from times gone by... go to that savedsearches.conf and remove the line vsid=gle4xmxd
from that saved search's stanza.
Sounds like a broken link from times gone by... go to that savedsearches.conf and remove the line vsid=gle4xmxd
from that saved search's stanza.
After editing .conf files manually you will need to either restart splunk or hit http://splunk_host:port/debug/refresh?entity=saved/search to tell splunk about the changed file.
There will be no impact because the viewstate apparently doesn't exist any more. Can't lose something that's already gone.
awesome thanks, this actually worked the URL is http://splunk_host:port/debug/refresh?entity=admin/savedsearch to do a refresh without restart
I already removed this from savedsearches.conf beforehand and still get the same error, am I supposed to restart the app for this to take effect? Further to this all alerts are actually resulting to this error message, so if I remove this, will there be any impact?