Other Usage

Scheduled Exported PDF Report of a Dashboard returning invalid earliest_time?

BigFishy
New Member

I have a dashboard that reports CDN Cache hit ratios. I have set this up as a static dashboard to email out to a group of people a performance score for their use. This used to work several months ago but recently my PDFs are showing the following error on all of my result queries: 

Invalid earliest_time

I reviewed my source code and set the token fields for earliest and latest times as follows. 

<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>

Variables are then referred to in the searches performed. 

 

What would be causing this return error on my scheduled reports? 

 

Labels (3)
Tags (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

It the problem only happening for the pdf? Is the dashboard loading as expected when you are opening it? 

Could not reproduce any issues created a dashboard below: 

<dashboard version="1.1">
  <init>
    <set token="field1.earliest">-7d@d</set>
    <set token="field1.latest">now</set>
  </init>
  <label>time_selector</label>
  <row>
    <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal by sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
     <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal earliest=$field1.earliest$ latest=$field1.latest$ by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

BigFishy
New Member

Dashboard loads as expected, yes. It's only when scheduling out a PDF export that I start getting errors. Even when previewing the export it shows me that error. If I do a manual export of the dashboard to a PDF that also generates the query as expected, so it's only when scheduling them out that I see this error

0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Oh that is strange. Look in the _internal index for any clues  to the problem. 

Search for keys like "sendemail" or "splunk_pdfgen"  or "Invalid value"

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...