Other Usage

Scheduled Exported PDF Report of a Dashboard returning invalid earliest_time?

BigFishy
New Member

I have a dashboard that reports CDN Cache hit ratios. I have set this up as a static dashboard to email out to a group of people a performance score for their use. This used to work several months ago but recently my PDFs are showing the following error on all of my result queries: 

Invalid earliest_time

I reviewed my source code and set the token fields for earliest and latest times as follows. 

<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>

Variables are then referred to in the searches performed. 

 

What would be causing this return error on my scheduled reports? 

 

Labels (3)
Tags (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

It the problem only happening for the pdf? Is the dashboard loading as expected when you are opening it? 

Could not reproduce any issues created a dashboard below: 

<dashboard version="1.1">
  <init>
    <set token="field1.earliest">-7d@d</set>
    <set token="field1.latest">now</set>
  </init>
  <label>time_selector</label>
  <row>
    <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal by sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
     <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal earliest=$field1.earliest$ latest=$field1.latest$ by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

BigFishy
New Member

Dashboard loads as expected, yes. It's only when scheduling out a PDF export that I start getting errors. Even when previewing the export it shows me that error. If I do a manual export of the dashboard to a PDF that also generates the query as expected, so it's only when scheduling them out that I see this error

0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Oh that is strange. Look in the _internal index for any clues  to the problem. 

Search for keys like "sendemail" or "splunk_pdfgen"  or "Invalid value"

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...