Unable to get viewstate information; formatting may not be correct

Unable to get viewstate information; formatting may not be correct

When I load a particular dashboard, I get the following error message in my dashboard page : –

Unable to get viewstate information; formatting may not be correct

Solution :

Step 1:

You can ofcourse remove the vsid key from all of your saved searches and that will make the error go away. However there is indeed some formatting information that was lost when you copied the files out.

Step 2:

You must have a saved search in your app’s savedsearches.conf  that refers to a

viewstate over in 

$SPLUNK_HOME/etc/users/<username>/<myApp>/local/viewstates.conf  .

You can tell this by looking for the vsid key in the stanzas. Unfortunately I don’t’ think it shows up on the manager UI. Most likely there are several such searches.

Step 3:

To restore the formatting by finding the viewstates and airlifting them out of the user directory and into your app.

However $SPLUNK_HOME/etc/users/<username>/<myApp>/local/viewstates.conf will have a TON of viewstates in it, and finding them all and filtering through the noise is quite tedious.

Step 4:

Delete all the vsid keys , but then go into your dashboards and put in all the chart formatting keys manually . If you are making an app and it’s not just some throwaway thing, this is the way to go.

# ssh Splunk-SearchHead  

# cd /opt/splunk/etc/apps/<myApp>/local

# vi savedsearches.conf

delete all the ‘vsid’ against the searches used by that dashboard.

#  /opt/splunk/bin/splunk restart

Now , check your dashboard , the error is GONE !!