Splunk.com specifies that if you want to use the pdf reporting you have to have xauth and xvfb installed on a Linux host. I spoke to our Unix admins at our company and they had said that they have xauth in the distribution but not xvfb and if we want to install it we have to find it ourselves and install it in a separate folder that we have access to on the box (we aren't allowed to become root on our servers)
Has anyone else had any issues installing this package and does anyone have any tips on how to do this yourself?
We have now installed this ourselves into a directory /app/Xvfb. Does anyone know what i need to update now to tell Splunk where to find the new binary?
that's interesting, i recently had a member of the support team edit the PDF Server installation docs to explicitly make that a lower-case x. is that not correct?
It is still not there. I checked on the server under
/usr/X11R6/bin/, Xvfb does not exist so we have to install it manually somewhere else if we want to use it...
How did you install it? Can you confirm that it works and doesn't complain about missing libraries? Also, you didn't mention what Linux distribution you're using, which would tell me what packages you need to install to satisfy dependencies. For example, on my Ubuntu 10.4 system, I see the following dependencies for xvfb:
xserver-common libc6 libgcrypt11 libpixman-1-0 libudev0 libxau6 libxdmcp6 libxfont1 xauth
Fedora/RHEL/debian/CentOS will have a different list of dependencies. Since you already have xauth, this may not be a problem, but YMMV.
Once you've confirmed that xvfb works, you'll have to set your $PATH variable so that Splunk knows where to find it. Another way would be to point the PDF server app on Splunk to your custom-installed xvfb binary, although I don't know how to do that. Because you've said you don't have root, you may need help from your friendly sysadmin to set $PATH.
hello! I added it to $PATH and I tested a search with a pdf report and it attached one successfully. But, the pdf report is such bad quality... I can't read the text at all... Has anyone got this to work with good quality pdfs? Am i missing a setting?
I've hears of some others solving this problem by installing an additional font package. To know which font package you're missing, I'll have to know what Linux distro you're using.