Error by generating PDF from Search Results

[oHable]

Hi,

every day i generate 8 reports which are converted to PDF. Then 1 send them by using EMail to an internal EMail adress. One of the 8 searchresults cannot be converted to PDF, the following error is written to /opt/splunk/var/log/splunk/python.log.
Any idea how to fix that? (sending the results as CSV is not the solution i am looking for :))

Search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)\%[013456789].|\%[a-f]."| table _time, host, clientip, method, uri, status

Note: %20 to %29 not included in this search :); search works, results as expected (in splunk).

OS: Linux xxx.xxxxx.xxxxx 2.6.18-348.4.1.el5 #1 SMP Fri Mar 22 05:41:51 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
CPU: 4 x Intel(R) Xeon(R) CPU X5680 @ 3.33GHz, 8GB Memory

Logfile: /opt/splunk/var/log/splunk/python.log

2013-07-15 07:36:47,876 +0200 ERROR pdfgen_endpoint:187 - Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable

...(423.275590551 x 1260) too large on page 2 in frame 'normal'(439.275590551 x 685.88976378*) of template 'Later'
2013-07-15 07:36:47,919 ERROR An error occurred while generating a PDF of this report: Failed to fetch PDF (status = 400): Unable to render PDF.

• Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable <Table@0x07E5BF38 564 rows x 7 cols>...(423.275590551 x 1260) too large on page 2 in frame 'normal'(439.275590551 x 685.88976378*) of template 'Later'

2013-07-15 07:36:47,955 INFO Sending email. subject="WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)", results_link="xxxxxxxxxxxx", recipients="['xxxxx@xxx.xx']"

sincerely oliver

[nmistry_splunk]

From the error: seems like the results table is too large to fit on page. The result table has 564 rows x 7 cols and probably its size is 423x1260 pixels.

If you dont mind, can you share the data or a screen shot of what is expected?

[oHable]

Hi,

thanks a lot for the fast response.

My solution is to define a kind of max field length by using the following rex:

rex field=uri max_match=0 "(?< uri >.{0,128})"

working search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)%[013456789].|%[a-f]."| rex field=uri max_match=0 "(?< uri >.{0,128})"| table _time, host, clientip, method, uri, status

works well, now the PDF is generated without any erros 🙂

sincerely oliver

Source: http://splunk-base.splunk.com/answers/84053/how-to-set-max-column-length