Can't attach PDF - ssName and pdfViewID unavailable

[atayarani_impri]

I'm trying to generate PDF reports with this search:

source="/var/log/messages" host="ejabber-1" | head 1 | sendemail sendpdf=true to=email address

I get the email, but I also get a PDF error in python.log:

An error occurred while generating a PDF of this report: Can't attach PDF - ssName and pdfViewID unavailable

PDF email does work via the scheduled PDF function.

I'm running Splunk 5.0.1 and CentOS 6.2.

[BernardEAI]

@atayarani_impri  This problem typically occurs when the name of the custom command does not match the name defined in the sendemail.py file. I encountered this when I made a copy of the default sendemail.py file to make our own custom sendemail command. I named the new command newsendemail (with the file newsendemail.py). 

In the file newsendemail.py, there is a piece of code:

sendemailRegex = r'\|\s*sendemail'
if (re.findall(sendemailRegex, searchToRun)):
  parameters['input-search'] = re.split(sendemailRegex, searchToRun)[0]
  parameters['et'] = jsonJob.get('earliestTime')
  parameters['lt'] = jsonJob.get('latestTime')
else:
  raise PDFException("Can't attach PDF - ssName and pdfViewID unavailable")

This is where that error is generated. For us, I had to change the 

r'\|\s*sendemail'

part to

r'\|\s*newsendemail'

The regex is searching for 'sendemail' in the search query, but the name of the custom command has been changed to 'newsendemail', so the regex needs to be updated. The error occurs if the regex does not find anything in the search query.

[krusty]

Hi, we still have a similar problem. We upgraded from 4.3.3. to 5.0.6 directly. After this we only got this message in the python.log if we try to generate scheduled reports from our views/dashboards.

2013-11-27 07:35:01,371 ERROR local variable 'ssName' referenced before assignment while sending mail to: my.mail@address.com

Does anybody found a solution to fix it?

[atayarani_impri]

This was answered for me in a ticket, but since I can't really explain why it works now, I'm going to leave this open for the others that need help.

[batcave]

anyone with any answer on this?

[feorlen]

Some other people ran into a problem with this message after upgrading, perhaps you customized some email settings in alert_actions.conf in a previous version? Seems we have a migration oopsie with that. Try commenting out any custom "command = " in your local/alert_actions.conf.

[krusty]

I tried your solution but nothing happens.

Before I read this article our local/alert_actions.conf Shows like this:

[email]
reportServerEnabled = 1
reportServerURL =
from = splunk@domain.com
mailserver = localhost

I changed it to this and restart the splunk server process.

[email]
from = splunk@domain.com
reportServerURL =

But unfortnately we have the same problem.

[atayarani_impri]

@bfinney, I still haven't heard back on this one. The answer would definitely be appreciated.

[bfinney]

Did you ever find a solution to this problem? I am getting the same error.
Thanks.