Why is there a scheduled dashboard PDF delivery issue after upgrading to 7.2.6?

[swmishra_splunk]

Reports are emailing out fine. Dashboards can be exported to PDFs fine. However anytime we try to send a Dashboard PDF via email (be it a test email or scheduled) no email is sent and we see the following internal log entry. This was working for many months (years?) and suddenly stopped working. And is true for any/all dashboards we have created.

2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results are empty, no email will be sent

[vinkumar_splunk · Accepted solution]

This is a known issue in Splunk and this will be fixed in 7.2.7.

Temporary Fix on 7.2.6:

Workaround 1:

Replace$SPLUNK_HOME/etc/apps/search/bin/ sendemail.py (https://sendemail.py/) with the one from version 7.2.5.1.

Workaround 2:

Go to Settings > All configurations > click on the ScheduledView_ that you've enabled "scheduled pdf delivery". The search field will default to "| noop", change it to "| makeresults".

I've done both in my lab environment and both of them are working.

[wryanthomas]

Seeing this with 7.2.9 in Splunk Cloud. (search is "| noop") Did this not get fixed in 7.2.7?

[wfrankl2]

This worked for me as well as we started experiencing it when moving to 7.2.6. Thanks for having the answer out here!!

[wfrankl2]

Workaround 2 that is. We are cloud so Workaround 1 would be a pain.

[Roger_FB]

Many thanks for the Workaround, but Workaround 2 did not work for me.
I will try Workaround 1 once. Can I download the file or the Version somewhere?

[vinkumar_splunk]

you can download a different Splunk version, ex: 7.2.5.1 and copy only sendemail.py from 7.2.5.1 and replace it with 7.2.6

Note: Let me know the challenges you're facing with Work Around 2, It should work

[Roger_FB]

Hi, okay, workaround 2 works. The reports are sent.

I have only tested the function "Send test mail", and this does not work for me.

Thank you very much for your help.