I'm trying to save the search, but getting this error:
Saved Search - Cisco -
Error - Encountered the following error while trying to update: In handler 'savedsearch': Cannot find viewstate with vsid="XXXXXXXXX"
Do you see any errors in splunkd.log or splunkd_access.log related to the "missing" viewstate? Perhaps there is some indication of a failure to create that viewstate.
Additionally, you need to have the ability to modify viewstates in any app where you want to save searches, even private saved searches. (IE: Write permissions) This is why apps like the search app (for example) make viewstates world-writable.
The relevant bit of configuration goes into $SPLUNK_HOME/etc/apps/your-app/metadata/default.meta
. For example, in $SPLUNK_HOME/etc/apps/search/metadata/default.meta:
### VIEWSTATES: even normal users should be able to create shared viewstates
[viewstates]
access = read : [ * ], write : [ * ]
export = system