topic Dashboard PDF email failing in Splunk Search

Dashboard PDF email failing

elumpkin_caisgr — Thu, 25 Apr 2019 16:19:14 GMT

A dashboard will export to PDF correctly, but anytime we try to send it via email (be it a test email or scheduled) no email is sent and we see the following internal log entry. This was working for many months (years?) and suddenly stopped working. And is true for any/all dashboards we have created.

2019-04-25 12:00:00,368 -0400 WARNING   sendemail:1398 - search results is empty, no email will be sent
host =       source = /apps/splunk/var/log/splunk/python.log      sourcetype = splunk_python

Splunk Enterprise
Version:
7.2.6
Build:
c0bf0f679ce9

Re: Dashboard PDF email failing

gailuh — Fri, 26 Apr 2019 08:56:02 GMT

The same problem occured for me. Workaround for this problem was to exchange the sendemail.py version. I used the sendemail.py version from Splunk 7.2.0 with full path: /etc/apps/search/bin/sendemail.py. Dashboard email sending working as usual afterwards.,

Re: Dashboard PDF email failing

JAvnaim — Mon, 29 Apr 2019 14:30:37 GMT

Hello,

I have the same issue, which appears to be introduced in 7.2.6, as email PDF delivery was working prior to upgrade.

I'd like to try the workaround, however am slightly confused as where to find the sendemail.py version from Splunk 7.2.0 ? Do I need install 7.2.0 and extract sendemail.py or is there an archive somewhere I could pull it from?

Thanks for your help!

Jordan

Re: Dashboard PDF email failing

dfgrtKJH — Wed, 08 May 2019 07:23:04 GMT

I have the same error.
Splunk 7.2.6
When sending Dashboard as pdf via mail (scheduled or with "send test email" command):
2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results is empty, no email will be sent

When i open the Dashboard in Splunk i see that it is not empty...

Re: Dashboard PDF email failing

dfgrtKJH — Wed, 08 May 2019 08:33:30 GMT

Splunk Support:

I understand that your PDF scheduled from dashboards are no longer working on 7.2.6. I confirmed this is a known issue and we are actively working on finding a solution for it.

We have found two possible workarounds:
- Replace sendemail.py from 7.2.6 with the same file in your older version.
- Edit your saved search, in the "Search" field replace "| noop" with "| makeresults".

For the moment, the issue is still unresolved.

Re: Dashboard PDF email failing

dfgrtKJH — Wed, 08 May 2019 09:23:28 GMT

solution if you do not have the old version:

create backup of /opt/splunk/etc/apps/search/bin/sendemail.py
open /opt/splunk/etc/apps/search/bin/sendemail.py (Splunk 7.2.6) with a editor as a user with write permissions.
remove line 1398 "logger.warn("search results is empty, no email will be sent")"
remove line 1397 "else:"
remove 4 spaces at the start of lines 1393-1396 (if, results=,else,results=)
remove line 1392 "if results:"
save file
test

Re: Dashboard PDF email failing

aaron_sakovich — Wed, 12 Jun 2019 21:15:51 GMT

We were having this problem with 7.2.6, and the issue was resolved with the 7.3 update -- though I could not find any reference to it in the release notes.

The contents of the sendemail.py program look markedly different, so obviously a lot of code therein was touched by this update.

Just glad it's working again,
Aaron

Re: Dashboard PDF email failing

dfgrtKJH — Thu, 13 Jun 2019 07:28:15 GMT

I can confirm this was fixed in 7.3.0.
Yes the changelog does not contains this bugfix, which is rather unprofessional in my optinion.
This thread can be closed.

Re: Dashboard PDF email failing

saramamurthy_sp — Mon, 25 Nov 2019 09:08:34 GMT

Does this workaround apply for 7.2.9 as well?