Dashboards & Visualizations

After upgrading search heads from 6.3 to 6.4.2, why does scheduling dashboard PDF delivery return sendemail error "'module' object has no attribute 'which_pdf_service'"?

Contributor

We have upgraded the Search Heads from 6.3 to 6.4.1

Ever since we upgraded, we are unable to schedule PDF Delivery from the dashboards.

We are receiving the following error:

tail -f /Data/splunk/var/log/splunk/python.log
2016-06-06 07:05:02,114 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 07:07:40,451 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 07:08:02,028 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 07:10:02,007 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 08:00:02,089 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'

All the other report based emails are being sent out.

Any help is appreciated 🙂

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Have you made any customization to sendemail.py in the app you are in or in the search app?

C:\Program Files\Splunk\etc\apps\search\bin # on my windows box here is where i find sendemail.py.

The error message suggests there was an error on line 1205, but i only have 1201 lines in the file from a fresh install.

View solution in original post

Communicator

Hi, I find source of my problem - which looks exactly like yours.

In my instalation, search app was not upgraded and still was on old 6.2.X version.
I repaired problem with manually copying sendemail.py from a newer splunk installation

0 Karma

SplunkTrust
SplunkTrust

Have you made any customization to sendemail.py in the app you are in or in the search app?

C:\Program Files\Splunk\etc\apps\search\bin # on my windows box here is where i find sendemail.py.

The error message suggests there was an error on line 1205, but i only have 1201 lines in the file from a fresh install.

View solution in original post

Path Finder

We upgraded on 10/23 to 6.4.3 and are experiencing this issue in our default Search application. We are going to open a case with Splunk, but just wanted everyone else to know.

0 Karma

SplunkTrust
SplunkTrust

@atari1050 Did you customize sendemail.py before the upgrade? If so it will probably have a modified date later than the date of all the other files in the same directory. Do you have a customized sendemail.py elsewhere in another app with export=system in the metadata (global setting in app manager)?

You should open another thread and relate back to this one if you want help with this via the community. It's rare folks will open an already answered question and help someone who "tacked" their issue to it.

0 Karma

Contributor

Okay, so this is what we did.

The issue was occurring with the customized apps and not with the default "search" app.

  1. Bring down the splunk service
  2. Copy the sendmail.py from the default "Search" app and paste it to the app you are facing this issue with. That is from /Data/splunk/etc/apps/search/bin/sendemail.py
  3. Then restart the splunk service.

This worked for us.

Let us know if this fixed.

SplunkTrust
SplunkTrust

I converted my comment to answer because I believe it put you in the right direction. Can you make your comment under my answer? I've tried moving it but without luck.

0 Karma

Contributor

Yes. I got the point. Thus i voted yours as the answer 😕

0 Karma

SplunkTrust
SplunkTrust

Ok thanks! Can you MARK it as the answer? Should be a link below the answer. Thanks again!

0 Karma

Contributor

Sure.

The real answer is Splunk does not modify customized apps and scripts and it ends up updating only the default"search" app. Thus, we have to move the sendemail.py from the default search app to the other customized/cloned apps.

0 Karma

SplunkTrust
SplunkTrust

That's exactly why I asked you "Have you made any customization to sendemail.py in the app you are in or in the search app?", splitting hairs here...

Technically, your app probably shouldn't have it's on sendemail.py. It appears you may be using the "search app" as a base for developing other apps, and that's not good if so. If your custom app didnt have this "custom" sendemail.py then the upgrade wouldnt have broken your send email functionality. I'm not saying it cant have it's own custom sendemail.py, just that it's rare you need a different sendemail.py for different apps, and if you do this intentionally, then you should be sure to review the newer splunk version of sendemail.py with every upgrade and merge the changes into your custom version of sendemail.py.

0 Karma

Communicator

I had another search head that wasn't part of the cluster, that was able to send the pdf via scheduled search. I'll copy the sendemail.py from it to the other boxes and see what happens. Thanks!

0 Karma

Contributor

Any luck ?

0 Karma

Contributor

When splunk migrates to a newer version, it updates only the search app and nothing else. Else, other apps and customized apps needs to be pushed by ourselves

0 Karma

Communicator

This is happening to me as well. Same scenario, though I'm on 6.4.1. I get the same error message as well. Have you gotten anywhere w/ this?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!