Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: [BUG] Why SPLUNK Dashboard export PDF resolves...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[BUG] Why SPLUNK Dashboard export PDF resolves Tokens but Scheduled PDF does not
I have a requirement to schedule a PDF weekly/monthly etc and show the Title of each section representing the Day From and Day To.
I created dynamic tokens and put that in the title. The dashboard shows it and when I click export PDF it shows appropriate dates but when I schedule a PDF the Auto Scheduled PDF doesn't show the dates, instead it shows $token_XX$ which means the tokens are not getting resolved with the auto scheduled PDF.
Modified the search query as I cant paste the original
Daily Stats - Report
<search>
<query>| makeresults
| eval currentDate=strftime(relative_time(now(),"-1d"),"%m/%d/%Y")
| eval minus1Date=strftime(relative_time(now(),"-1d"),"%m/%d/%Y")</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="tok_cur_Date">$result.currentDate$</set>
<set token="tok_minus1_Date">$result.minus1Date$</set>
</done>
</search>
<panel>
<html>
<style>.chartTitleText {font-size: 16px; font-weight:bold;}</style>
<p class="chartTitleText">$tok_minus1_Date$ to $tok_cur_Date$</p>
</html>
<single>
<title>Availability (Rounded after 2 Decimals)</title>
<search>
<query>index="prod" source="*" | stats count(eval(isSuccessful="Y")) as SUCCESS_COUNT count as TOTAL | eval ATB=SUCCESS_COUNT/TOTAL*100 | table ATB</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
</single>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Refer to the below URL. This document clearly says that "Search result" and "Job information" tokens are not available for Scheduled PDF Delivery.
For scheduled PDF delivery, you can use tokens in the following fields of an email:
Subject
Message
Footer
See below document for more information.
http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DashboardPDFs
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@arayapati83 I have updated your question to highlight your issue. Also adding the reference to the previous question where the issue is discussed: https://answers.splunk.com/answers/526670/display-datetime-range-in-dashbaord.html
As requested, if you have Splunk Entitlement, please reach out to Splunk Support to have the issue resolved!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay when you say splunk support are u saying to reach splunk support team at my organization?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your organisation has purchased Splunk Support there would be an Entitlement Number which can be used to create a ticket with Splunk Support Team.
You can begin with your own Splunk Support Team for the details on this.
Could you also let us know as to what is the schedule of the Dashboard PDF generation?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay we have multiple.. monthly and quarterly is what we are most interested in
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would say do it manually until issue is resolved. Figure out who can create a case with Splunk Support or whether they have a workaround.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@p_gurav so r u saying its not possible at all?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
