Other Usage

Scheduled Exported PDF Report of a Dashboard returning invalid earliest_time?

BigFishy
New Member

I have a dashboard that reports CDN Cache hit ratios. I have set this up as a static dashboard to email out to a group of people a performance score for their use. This used to work several months ago but recently my PDFs are showing the following error on all of my result queries: 

Invalid earliest_time

I reviewed my source code and set the token fields for earliest and latest times as follows. 

<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>

Variables are then referred to in the searches performed. 

 

What would be causing this return error on my scheduled reports? 

 

Labels (3)
Tags (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

It the problem only happening for the pdf? Is the dashboard loading as expected when you are opening it? 

Could not reproduce any issues created a dashboard below: 

<dashboard version="1.1">
  <init>
    <set token="field1.earliest">-7d@d</set>
    <set token="field1.latest">now</set>
  </init>
  <label>time_selector</label>
  <row>
    <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal by sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
     <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal earliest=$field1.earliest$ latest=$field1.latest$ by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

BigFishy
New Member

Dashboard loads as expected, yes. It's only when scheduling out a PDF export that I start getting errors. Even when previewing the export it shows me that error. If I do a manual export of the dashboard to a PDF that also generates the query as expected, so it's only when scheduling them out that I see this error

0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Oh that is strange. Look in the _internal index for any clues  to the problem. 

Search for keys like "sendemail" or "splunk_pdfgen"  or "Invalid value"

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...