Strange behavior with alert, send email with PDF.

[las]

Hi.

I have a problem with the configuration of alert - send email with a pdf as attachment.

I use Splunk 5.0.1 on windows.
I had it working this morning, but then I tried to remove the Splunk search from normal alerts, without PDF. I have tried to restore action_alerts.conf and sendemail.py.

My problem is that instead of attaching a PDF, it attaches a CSV file.

I have done some debugging on the sendemail.py, and it does receive sendpdf=false. if I force it programaticaly to true, I get a PDF, so I don't think it's the python script.

My saved search has the following stanzas:
[License_monitor]

action.email = 1

action.email.format = pdf

action.email.sendresults = 1

If I call sendemail from a search, I also get a csv file instead of a PDF:
|sendemail to=name@company.com subject="Something" sendresults=true server=mailserver.company.com format=text inline=false sendpdf=true.

I obviously have made an error somwhere, but I can't find it again.

Kind regards

[nmistry_splunk · Accepted solution]

setting action.email.sendpdf = 1 in your savedsearches.conf should resolve the issue.

[las]

It seems like there might be a problem, with the Splunk-Web interface, as it at least once, in my case, set action.email.sendpdf = 0, when I choose pdf in the gui.
When setting it directly in the conf file, and restarting Splunk, it works.

[Michael_Schyma1]

Also when i just add it to the search inside of the seavedsearches.conf. i get An error occurred while generating a PDF of this report:
Didn't receive PDF from Report Server

Didnt think we needed this with 5.0.1

[Michael_Schyma1]

Thank you, Where exactly does this go within savedsearches.conf?

Also is this a global change, or will it just go in the stanza for that specific search?

[Michael_Schyma1]

I am having the same issue. Did you or anyone ever figure out a solution to this issue?