I have a large report that generates about 50 pages in PDF. The report is generated from a dashboard that contains 6 panels, all scheduled searches.
For the most part it works, but since the report has grown larger, the PDF Server fails to render the last 2 panels (at the end or the report). It just provides an empty box with the title and time of run. Manually going in and viewing the dashboard works fine.
I'd love to hear that there is some obscure parameter I can set that will allow me to workaround this.
You could be hitting pdfreport server app page timeout, defaults to 180 seconds.
Splunk will wait for dashboard's print ready event or timeout event to occur, which ever happens first, to actually generate PDF. In your case it could be that it takes more than 180s to generate your 50 pager thereby resulting in empty modules in pdfs.
Try to update this firefox_timeout config in $SPLUNK_HOME/etc/apps/pdfserver/local/pdf_server.conf file to a larger number, equivalent to time in seconds it will take to load the complete page.
Thanks for your answer but:
1) The report is scheduled to run at 8am and arrives at 8am. So it is unlikely hitting the 180 seconds (3 minutes) timeout.
2) I've tried raising the value previously with no change in behavior.