I have a problem with the configuration of alert - send email with a pdf as attachment.
I use Splunk 5.0.1 on windows.
I had it working this morning, but then I tried to remove the Splunk search from normal alerts, without PDF. I have tried to restore action_alerts.conf and sendemail.py.
My problem is that instead of attaching a PDF, it attaches a CSV file.
I have done some debugging on the sendemail.py, and it does receive sendpdf=false. if I force it programaticaly to true, I get a PDF, so I don't think it's the python script.
My saved search has the following stanzas:
action.email = 1
action.email.format = pdf
action.email.sendresults = 1
If I call sendemail from a search, I also get a csv file instead of a PDF:
|sendemail firstname.lastname@example.org subject="Something" sendresults=true server=mailserver.company.com format=text inline=false sendpdf=true.
I obviously have made an error somwhere, but I can't find it again.
action.email.sendpdf = 1 in your savedsearches.conf should resolve the issue.
Thank you, Where exactly does this go within savedsearches.conf?
Also is this a global change, or will it just go in the stanza for that specific search?
Also when i just add it to the search inside of the seavedsearches.conf. i get An error occurred while generating a PDF of this report:
Didn't receive PDF from Report Server
Didnt think we needed this with 5.0.1
It seems like there might be a problem, with the Splunk-Web interface, as it at least once, in my case, set action.email.sendpdf = 0, when I choose pdf in the gui.
When setting it directly in the conf file, and restarting Splunk, it works.