Dashboards & Visualizations

Why am I getting a scheduled search "datetime strftime() error", and some panels fail to render in the scheduled PDF email?

ejharts2015
Communicator

I have a dashboard which loads a bunch of scheduled reports. This dashboard is emailed to me via pdf at 6 pm everyday. The dashboard loads/works fine, however, the pdf doesn't show all the panels.

The first panel displays correctly:
Here is the search:

index=_internal source=*license_usage.log* type=Usage earliest=@d-6h latest=@d+18h | fields b,idx,_time   | timechart span=1h sum(b) by idx  | foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]

The Second panel doesn't display at all, with no error. It's just blank.
Here is the search:

index=_internal source=*license_usage.log* type=Usage earliest=@d-6h latest=@d+18h | fields b,idx,_time   | timechart span=1h sum(b) by idx  | addcoltotals | fillnull value=TOTAL | search _time=TOTAL |  foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]

The final panel has the following error: "year=1 is before 1900; the datetime strftime() methods require year >= 1900"
Here is the search:

index=_internal source=*license_usage.log* type=Usage earliest=@d-6h latest=@d+18h | fields b,idx,_time   | timechart span=1h sum(b) by idx  | addcoltotals | fillnull value=TOTAL | foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]

What is making the last two panels fail to render via the scheduled pdf?

0 Karma
1 Solution

ggiessen
Explorer

It looks like convert is having issues...

add this to your query and pdf export works fine:

| rename _time as Date | convert ctime(Date) timeformat="%Y-%m-%d"

View solution in original post

ggiessen
Explorer

It looks like convert is having issues...

add this to your query and pdf export works fine:

| rename _time as Date | convert ctime(Date) timeformat="%Y-%m-%d"

ejharts2015
Communicator

It's very weird that that worked... but thanks! It was driving me crazy 🙂

0 Karma

kira01
New Member

@ejharts2015
how did you schedule email of dashboard pdf?
I want to schedule pdf delivery of dashboard using one of the conf files. But unable to do so. Can you help?

0 Karma

ejharts2015
Communicator

What issue are you having with it?

0 Karma

darrend
Path Finder

I had the same issue on a customers site this morning.

This was just after an upgrade from 6.2.x to 6.3.x, it appears that if the _time field is present on some results then it cannot be null value(or possibly non-date value) on other results. This empty/null value was caused by the addtotals command for us.

This only appears to affect the pdf generation, the screen rendered fine.

kfir_fireglass
Engager

Experiencing the same issue. Also for me it affects only my pdf generation.

Couldn't find any workaround. I eventually removed the time field from the report.

0 Karma

RobertaRimondo
Explorer

Same problem here, the addtotals command caused the error message above when exporting to PDF. Workaround: simply renaming the _time field with a different name (I used "Month") in the final table. It works!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...