Alerting

Why does cloning of any alerts or saved searches in an app result in error "Viewstate object not found..."?

helenashton
Path Finder

Cloning of any alerts/saved searches in an app are causing the following error (Splunk search head v 6.2):

Encountered the following error while trying to clone: [HTTP 404] Viewstate object not found; view=* viewstate=33333333

I can fix this for an individual case by removing the vsid (as suggested elsewhere), however, it is not practical to do this for everything in an app.

I have checked this app against others (which don't have this error) and the permissions are the same.

Any ideas?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The clone problem exists because the Viewstate ID (vsid) is not present in the viewstates.conf. You can either add an remove viewstate for the object or copy the source state by doing the following:

viewstates.conf
...
[*:33333333]
...
0 Karma

helenashton
Path Finder

thanks - additional understanding 🙂
so I can either remove the vsid from savedsearches.conf, or add it into viewstates.conf

useful, but still something I need to do for each vsid.

Any idea for an app wide fix? Or why this would have happened in the first place?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...