Reporting

Scheduled Exported PDF Report of a Dashboard returning invalid earliest_time?

BigFishy
New Member

I have a dashboard that reports CDN Cache hit ratios. I have set this up as a static dashboard to email out to a group of people a performance score for their use. This used to work several months ago but recently my PDFs are showing the following error on all of my result queries: 

Invalid earliest_time

I reviewed my source code and set the token fields for earliest and latest times as follows. 

<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>

Variables are then referred to in the searches performed. 

 

What would be causing this return error on my scheduled reports? 

 

Labels (3)
Tags (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

It the problem only happening for the pdf? Is the dashboard loading as expected when you are opening it? 

Could not reproduce any issues created a dashboard below: 

<dashboard version="1.1">
  <init>
    <set token="field1.earliest">-7d@d</set>
    <set token="field1.latest">now</set>
  </init>
  <label>time_selector</label>
  <row>
    <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal by sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
     <panel>
      <chart>
        <title>Events by sourcetype</title>
        <search>
          <query>| tstats count where index=_internal earliest=$field1.earliest$ latest=$field1.latest$ by sourcetype</query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</dashboard>
0 Karma

BigFishy
New Member

Dashboard loads as expected, yes. It's only when scheduling out a PDF export that I start getting errors. Even when previewing the export it shows me that error. If I do a manual export of the dashboard to a PDF that also generates the query as expected, so it's only when scheduling them out that I see this error

0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Oh that is strange. Look in the _internal index for any clues  to the problem. 

Search for keys like "sendemail" or "splunk_pdfgen"  or "Invalid value"

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...