Why are some of my charts not displayed properly after exporting my dashboard to a PDF file?

[hnoboru_splunk]

I have a dashboard which has 10 charts, and I set it up to refresh every 10 seconds.

<refresh>10s</refresh>

When I exported the dashboard to a PDF file, some of my charts were not displayed properly. (The other charts were showing properly.)

Instead, URLs like below are shown, and when I tried to access the URL, Unknow sid error is shown up on the browser.

https://IP:8089/services/search/jobs/admin__admin__search__search8_1548139350.27149/results?count=10...>

{"messages":[{"type":"FATAL","text":"Unknown sid."}]}

[hnoboru_splunk]

[Answer]

This issue is happening due to the timing of dashboard refresh and pdf export.

When a dashboard is due to refresh, it calls cancel of all the dashboard search jobs and request for a fresh run.
This issue happens when refresh kicks while pdfgen is still rendering the searches.
This is a limitation to PDF generation. (We'll update the document soon.)

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/DashboardPDFs

[Workaround]

• Change the refresh time to a bigger value (the issue still happens, but the frequency becomes lesser.)
• Disable the refresh time and change the search to real-time search *Please note real-time search consumes more resources.

　　　　https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Aboutrealtimesearches

[Behavior]

• dashboard
  

  0. Dashboard is updated.
  
  
  1. Wait for the refresh time.
  
  
  2. The refresh time has passed.
  
  
  3. Change the status of searches to cancel. (To prevent Splunk having 2 valid search results.)
  
  
  4. Request a new search, and return to 0.

• pdfgen
  

  a. Find all Search IDs for all searches.
  
  
  b. Render the search results using data in the corresponding folders under dispatch.
  
  
  c. PDF is created.