Reporting

Error by generating PDF from Search Results

oHable
Explorer

Hi,

every day i generate 8 reports which are converted to PDF. Then 1 send them by using EMail to an internal EMail adress. One of the 8 searchresults cannot be converted to PDF, the following error is written to /opt/splunk/var/log/splunk/python.log.
Any idea how to fix that? (sending the results as CSV is not the solution i am looking for :))

Search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)\%[013456789].|\%[a-f]."| table _time, host, clientip, method, uri, status

Note: %20 to %29 not included in this search :); search works, results as expected (in splunk).

OS: Linux xxx.xxxxx.xxxxx 2.6.18-348.4.1.el5 #1 SMP Fri Mar 22 05:41:51 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
CPU: 4 x Intel(R) Xeon(R) CPU X5680 @ 3.33GHz, 8GB Memory

Logfile: /opt/splunk/var/log/splunk/python.log

2013-07-15 07:36:47,876 +0200 ERROR pdfgen_endpoint:187 - Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable

...(423.275590551 x 1260) too large on page 2 in frame 'normal'(439.275590551 x 685.88976378*) of template 'Later'
2013-07-15 07:36:47,919 ERROR An error occurred while generating a PDF of this report: Failed to fetch PDF (status = 400): Unable to render PDF.
  • Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable <Table@0x07E5BF38 564 rows x 7 cols>...(423.275590551 x 1260) too large on page 2 in frame 'normal'(439.275590551 x 685.88976378*) of template 'Later'

2013-07-15 07:36:47,955 INFO Sending email. subject="WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)", results_link="xxxxxxxxxxxx", recipients="['xxxxx@xxx.xx']"

sincerely oliver

Tags (1)

nmistry_splunk
Splunk Employee
Splunk Employee

From the error: seems like the results table is too large to fit on page. The result table has 564 rows x 7 cols and probably its size is 423x1260 pixels.

If you dont mind, can you share the data or a screen shot of what is expected?

0 Karma

oHable
Explorer

Hi,

thanks a lot for the fast response.

My solution is to define a kind of max field length by using the following rex:

rex field=uri max_match=0 "(?< uri >.{0,128})"

working search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)%[013456789].|%[a-f]."| rex field=uri max_match=0 "(?< uri >.{0,128})"| table _time, host, clientip, method, uri, status

works well, now the PDF is generated without any erros 🙂

sincerely oliver

Source: http://splunk-base.splunk.com/answers/84053/how-to-set-max-column-length

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...