Reports are emailing out fine. Dashboards can be exported to PDFs fine. However anytime we try to send a Dashboard PDF via email (be it a test email or scheduled) no email is sent and we see the following internal log entry. This was working for many months (years?) and suddenly stopped working. And is true for any/all dashboards we have created.
2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results are empty, no email will be sent
This is a known issue in Splunk and this will be fixed in 7.2.7.
Temporary Fix on 7.2.6:
Replace$SPLUNK_HOME/etc/apps/search/bin/ sendemail.py (https://sendemail.py/) with the one from version 220.127.116.11.
Go to Settings > All configurations > click on the ScheduledView_ that you've enabled "scheduled pdf delivery". The search field will default to "| noop", change it to "| makeresults".
I've done both in my lab environment and both of them are working.
Many thanks for the Workaround, but Workaround 2 did not work for me.
I will try Workaround 1 once. Can I download the file or the Version somewhere?
you can download a different Splunk version, ex: 18.104.22.168 and copy only sendemail.py from 22.214.171.124 and replace it with 7.2.6
Note: Let me know the challenges you're facing with Work Around 2, It should work
Hi, okay, workaround 2 works. The reports are sent.
I have only tested the function "Send test mail", and this does not work for me.
Thank you very much for your help.
This worked for me as well as we started experiencing it when moving to 7.2.6. Thanks for having the answer out here!!
Seeing this with 7.2.9 in Splunk Cloud. (search is "| noop") Did this not get fixed in 7.2.7?