Deployment Architecture

Pdf Reporting packages - xauth & xvfb

Hazel
Communicator

Hello,

Splunk.com specifies that if you want to use the pdf reporting you have to have xauth and xvfb installed on a Linux host. I spoke to our Unix admins at our company and they had said that they have xauth in the distribution but not xvfb and if we want to install it we have to find it ourselves and install it in a separate folder that we have access to on the box (we aren't allowed to become root on our servers)

Has anyone else had any issues installing this package and does anyone have any tips on how to do this yourself?


We have now installed this ourselves into a directory /app/Xvfb. Does anyone know what i need to update now to tell Splunk where to find the new binary?

Tags (2)
0 Karma

John_Mark
Splunk Employee
Splunk Employee

How did you install it? Can you confirm that it works and doesn't complain about missing libraries? Also, you didn't mention what Linux distribution you're using, which would tell me what packages you need to install to satisfy dependencies. For example, on my Ubuntu 10.4 system, I see the following dependencies for xvfb:

xserver-common libc6 libgcrypt11 libpixman-1-0 libudev0 libxau6 libxdmcp6 libxfont1 xauth

Fedora/RHEL/debian/CentOS will have a different list of dependencies. Since you already have xauth, this may not be a problem, but YMMV.

Once you've confirmed that xvfb works, you'll have to set your $PATH variable so that Splunk knows where to find it. Another way would be to point the PDF server app on Splunk to your custom-installed xvfb binary, although I don't know how to do that. Because you've said you don't have root, you may need help from your friendly sysadmin to set $PATH.

0 Karma

jrodman
Splunk Employee
Splunk Employee

dejavu should at least be installed. Ideally installing the firefox package will pull in sufficient fonts to get reasonable rendering of web pages. Perhaps you can just ask rpm what packages it depends on, and grep through there for the font list?

0 Karma

Hazel
Communicator

Hello, are you able to help with what font packages we need for RedHat & Suse?

0 Karma

Hazel
Communicator

We use RedHat or Suse

0 Karma

John_Mark
Splunk Employee
Splunk Employee

I've hears of some others solving this problem by installing an additional font package. To know which font package you're missing, I'll have to know what Linux distro you're using.

0 Karma

Hazel
Communicator

hello! I added it to $PATH and I tested a search with a pdf report and it attached one successfully. But, the pdf report is such bad quality... I can't read the text at all... Has anyone got this to work with good quality pdfs? Am i missing a setting?

0 Karma

thomasknowles
Engager

Try Xvfb (capital X)

Hazel
Communicator

It is still not there. I checked on the server under
/usr/X11R6/bin/, Xvfb does not exist so we have to install it manually somewhere else if we want to use it...

0 Karma

piebob
Splunk Employee
Splunk Employee

aha, it's xvfb on debian (and probably ubuntu) and Xvfb on Redhat/Centos/Fedora.

0 Karma

piebob
Splunk Employee
Splunk Employee

that's interesting, i recently had a member of the support team edit the PDF Server installation docs to explicitly make that a lower-case x. is that not correct?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...