How to resolve these viewstate error messages?
"Unable to get viewstate information for Juniper - Top 5 Outbound Deny Hosts for TCP Port 80; formatting may not be correct"
This dashboard uses simple XML and lives in an App created using the Manager. The App contains a savedsearches.conf file and another dashboard which uses advanced XML. Both dashboards call different searches from savedsearches.conf. The dashboard with advanced XML loads just fine (no viewstate errors).
Strangely enough, converting the simple XML dashboard to advanced XML fixed the problem. This can't be the solution. There must be a bug or something missing.
I checked for possible duplicates of the saved search, deleted all related viewstates.conf files, even installed the App in a brand new Splunk instance. I also checked permissions on the dashboard XML files and savedsearches.conf and verified the existence of the local folders as Emma suggested in a recent support case. None of these actions made a difference.
To be honest, I don't know why the error shows up. Possibly it's just because the message is at too high an alert level. You can fix this however by editing the savedsearches.conf file and removing the vsid property on the saved search. This will lose the viewstate properties, but viewstate should be considered transient anyway. (You should explicitly say how you want results to be rendered when you define your dashboard and modules and not rely on viewstate.)
I built a small app for a customer last week and I am seeing the same behavior. It is a little baffling since the app is so simple.
Seeing this in 4.1.4 -- any fixes?
We ran into what sounds like the same issue.
We have a set of dashboards called Snapshots that refer to saved/scheduled searches. These were created inside an application we named Snapshot.
It would be great to have these also show up inside other applications, but when we tried just sharing the searches and dashboards globally and adding the dashboards to the navigation of a second app, then we get the error
"Unable to get viewstate information for DASHBOARD_NAME; formatting may not be correct"
The search runs from scratch, instead of pulling up the results from the last saved search.
Hoping there's a way to get it to use the results.
Thanks, Nancy
To be honest, I don't know why the error shows up. Possibly it's just because the message is at too high an alert level. You can fix this however by editing the savedsearches.conf file and removing the vsid property on the saved search. This will lose the viewstate properties, but viewstate should be considered transient anyway. (You should explicitly say how you want results to be rendered when you define your dashboard and modules and not rely on viewstate.)
I too had this problem and removed all vsids from all my savedsearches.conf, but it wouldn't go away. The problem is if you don't restart splunk, the error won't clear. I thought I could just restart splunk web, but nope. Full splunk restart FINALLY cleared it.
I'm getting similar warning. "Unable to get viewstate information; formatting may not be correct".
There isn't any information with what search or dashboard is problem so I don't even know on what dashboard should I look for it. ; /
Both. I deleted it everywhere it existed.
@hulahoop, did you delete the vsid parameter in your own private savedsearches.conf, or only in the app one?
Deleting the vsid params and restarting didn't work for me. The dashboards were simple data tables and had no charts. Is there view state associated with data tables?