All Apps and Add-ons

Unable to get viewstate information

mhasling
Engager

I have created an application and got everything working well with tables using saved searches. I moved my application from one instance to another by zipping up /etc/apps/myApp and dropping it into the other instance. Things worked great except that I get a banner across the top tell me "Unable to get viewstate information; formatting may not be correct". All of the searches that I am using are within my app, have I missed a file when copying over to a new instance?

Anyone know what could cause this error or how I can get more detail about what is going on?

Thanks!

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

You must have a saved search in your app's savedsearches.conf that refers to a viewstate over in $SPLUNK_HOME/etc/users/<username>/myApp/local/viewstates.conf. You can tell this by looking for the 'vsid' key in the stanzas. Unfortunately I dont think it shows up in the manager UI.
Most likely there are several such searches.

1) You can of course remove the vsid key from all your saved searches and that will make the error go away.

However there is indeed some formatting information that was lost when you copied the files out.

2) To restore the formatting by finding the viewstates and airlifting them out of the user directory and into your app. However /etc/users/<username>/local/viewstates.conf will have a TON of viewstates in it, and finding them all and filtering through the noise is quite tedious.

3) delete all the vsid keys, but then go into your dashboards and put in all the chart formatting keys manually. If you're making an app and it's not just some throwaway thing, this is the way to go. The official charting docs are a little overwhelming

http://www.splunk.com/base/Documentation/4.2.1/Developer/CustomChartingConfig-Overview

but it's a good bet that you were only using these two keys:

charting.chart = line | column | bar | area | pie
charting.chart.stackMode = none | stacked 

View solution in original post

SarahBOA
Path Finder

We are also looking for why this happens and how to make it stop. We are able to go in and clean out the vsid's from the savedsearches.conf file, but we have to do this over and over. When is this vsid created? Is it created when a user creates a panel by saving an existing search? Is there any way to block the message from appearing?

Narj
Path Finder

I've just come across this issue but can't find any reference to any of the problematic saved search VSIDs in any of the etc/users/APPNAME/local/viewstates.conf files. :S

This is highly annoying - is there any recommended way to stop this from being a problem when creating an app besides manually defining all the chart options in the XML?

0 Karma

sideview
SplunkTrust
SplunkTrust

You must have a saved search in your app's savedsearches.conf that refers to a viewstate over in $SPLUNK_HOME/etc/users/<username>/myApp/local/viewstates.conf. You can tell this by looking for the 'vsid' key in the stanzas. Unfortunately I dont think it shows up in the manager UI.
Most likely there are several such searches.

1) You can of course remove the vsid key from all your saved searches and that will make the error go away.

However there is indeed some formatting information that was lost when you copied the files out.

2) To restore the formatting by finding the viewstates and airlifting them out of the user directory and into your app. However /etc/users/<username>/local/viewstates.conf will have a TON of viewstates in it, and finding them all and filtering through the noise is quite tedious.

3) delete all the vsid keys, but then go into your dashboards and put in all the chart formatting keys manually. If you're making an app and it's not just some throwaway thing, this is the way to go. The official charting docs are a little overwhelming

http://www.splunk.com/base/Documentation/4.2.1/Developer/CustomChartingConfig-Overview

but it's a good bet that you were only using these two keys:

charting.chart = line | column | bar | area | pie
charting.chart.stackMode = none | stacked 
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...