Reporting

50 page PDF report not fully rendering (4.3.4)

the_wolverine
Champion

I have a large report that generates about 50 pages in PDF. The report is generated from a dashboard that contains 6 panels, all scheduled searches.

For the most part it works, but since the report has grown larger, the PDF Server fails to render the last 2 panels (at the end or the report). It just provides an empty box with the title and time of run. Manually going in and viewing the dashboard works fine.

I'd love to hear that there is some obscure parameter I can set that will allow me to workaround this.

alt text

0 Karma

nmistry_splunk
Splunk Employee
Splunk Employee

You could be hitting pdfreport server app page timeout, defaults to 180 seconds.

Splunk will wait for dashboard's print ready event or timeout event to occur, which ever happens first, to actually generate PDF. In your case it could be that it takes more than 180s to generate your 50 pager thereby resulting in empty modules in pdfs.

Try to update this firefox_timeout config in $SPLUNK_HOME/etc/apps/pdfserver/local/pdf_server.conf file to a larger number, equivalent to time in seconds it will take to load the complete page.

the_wolverine
Champion

Thanks for your answer but:
1) The report is scheduled to run at 8am and arrives at 8am. So it is unlikely hitting the 180 seconds (3 minutes) timeout.
2) I've tried raising the value previously with no change in behavior.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...