After upgrading from Splunk 6.1 to 6.3, why am I unable to generate a PDF with error "Splunkd daemon is not responding...The read operation timed out"?

[ulikabbq]

I am unable to generate a pdf since I upgraded from 6.1 to 6.3. I get this message when I try to export a report to a pdf:

Unable to render PDF.
Exception raised while trying to prepare "Report" for rendering to PDF. Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/search/search/parser: ('The read operation timed out',)",)

It is able to export a CSV with no issues.

When I have the report set to send an email with a PDF attachment. I get this error:

An error occurred while generating the PDF. Please see python.log for details

The python log shows a similiar error

sendemail:988 - An error occurred while generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF.  

• Exception raised while trying to prepare "Report" for rendering to PDF. Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/search/search/parser: ('The read operation timed out',)",)

[emmanuel_hivert]

i have a similar message but code error 1013 in .6.4.3 . i change web.conf or Limits.conf

sendemail:1013 - An error occurred whil
e generating a PDF: Failed to fetch PDF (status = 400): Unable to render PDF.

• Exception raised while trying to prepare "Liste des IP à surveiller"
  for rendering to PDF. Splunkd daemon is not responding: ("Error connecting to
  /servicesNS/admin/Reverse/search/parser: ('The read operation timed out',)",)</
  

[abhullar_splunk]

Look for the following setting under limits.conf and increase the timeout:

render_endpoint_timeout =
* The number of seconds after which the pdfgen render endpoint will timeout if
it has not yet finished rendering the PDF output
* Defaults to 3600

[jdswanson]

Check the update from sgarvin55 here: https://answers.splunk.com/answers/39685/pdfserver-the-read-operation-timed-out-on-dashboard-renderi... Looks like you might want to adjust the SplunkdConnectionTimeout in web.conf.

[ulikabbq]

well I changed the timeout in the web.conf to 60 sec and it doesn't seem to wait that long.

I don't have any issue exporting to any other format, but the pdf generator is not working for me on 6.3. I have about 40+ reports that are staggered throughout the night and they send pdf reports to people. Only about 10% of those worked last night, and the cpu got pegged out in the process.

[jdswanson]

Ever have any luck with this?

[ulikabbq]

There is a issue exporting reports with subsearches to pdf. They timeout every time. Even thought the search will execute the report will never generate a pdf. I have a bug filed with Splunk on this issue. For now I was able to rewrite most of my searches to not use a subsearch and the ones I couldn't are just generating csv files for now.

[erikgrasman]

We experience the samen issues, did you get a reply from Splunk, solution or solution expected in release 6.3.x?

[ChrisLH]

We are working on Splunk 6.6 with a similar issue, did you people find a solution that except for removing sub searches / editing web.conf ?

[ulikabbq]

ok. a couple splunk restarts seemed to clear this issue up