Splunk Search

Viewstates Error when trying to save/clone/edit search

JDukeSplunk
Builder

So we have a number of searches that cannot be saved or cloned due to viewstate errors. Many of them are accelerated and scheduled and I need to be able to edit them so that they run properly.

alt text

I have checked this answer HERE

I confirmed that my $SPLUNK_HOME/etc/apps/search/metadata/default.meta file has the right entry for viewstates. As shown.
alt text

I have taken some of them and recreated them as new searches, and they saved just fine. Then I can delete them without issue.

What else might I try?

1 Solution

woodcock
Esteemed Legend

Go to the CLI on the Search Head, find the savedsearches.conf file that has the viewstate in it (if *nix, you can use find $SPLUNK_HOME/etc/ -name savedsearches.conf -exec grep -l hqfssli4 {} \;). Stop splunk, edit the file and REMOVE the viewstate line entirely, save it, restart splunk, enjoy. Make a backup of the file first.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Go to the CLI on the Search Head, find the savedsearches.conf file that has the viewstate in it (if *nix, you can use find $SPLUNK_HOME/etc/ -name savedsearches.conf -exec grep -l hqfssli4 {} \;). Stop splunk, edit the file and REMOVE the viewstate line entirely, save it, restart splunk, enjoy. Make a backup of the file first.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...