Other Usage

Scheduled Exported PDF Report of a Dashboard returning invalid earliest_time?

BigFishy
New Member

I have a dashboard that reports CDN Cache hit ratios. I have set this up as a static dashboard to email out to a group of people a performance score for their use. This used to work several months ago but recently my PDFs are showing the following error on all of my result queries: 

Invalid earliest_time

I reviewed my source code and set the token fields for earliest and latest times as follows. 

<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>

Variables are then referred to in the searches performed. 

 

What would be causing this return error on my scheduled reports? 

 

Labels (3)
Tags (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

It the problem only happening for the pdf? Is the dashboard loading as expected when you are opening it? 

Could not reproduce any issues created a dashboard below: 

<dashboard version="1.1">
  <init>
    <set token="field1.earliest">-7d@d</set>
    <set token="field1.latest">now</set>
  </init>
  <label>time_selector</label>
  <row>
    <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal by sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
     <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal earliest=$field1.earliest$ latest=$field1.latest$ by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

BigFishy
New Member

Dashboard loads as expected, yes. It's only when scheduling out a PDF export that I start getting errors. Even when previewing the export it shows me that error. If I do a manual export of the dashboard to a PDF that also generates the query as expected, so it's only when scheduling them out that I see this error

0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Oh that is strange. Look in the _internal index for any clues  to the problem. 

Search for keys like "sendemail" or "splunk_pdfgen"  or "Invalid value"

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...