Reporting

Trigger a PDF via the command line

vincesesto
Communicator

Hello,

I would like to create a script that would trigger a pdf creation of a dashboard. I understand how to create a pdf and send via a saved search, but I would like to use a script to perform the same function.

I am having a little trouble understanding how the pdf renderer works and cannot find any documentation that would describe how to do this...Does anyone have any ideas?

Regards Vince

shrtando
New Member

Hi,
I have exactly same requirement where create a dashboard and schedule PDF delivery for that.
I am new to splunk REST API concepts. Can you please explain the script mentioned here
what is PDF Trigger here? Is it an alert with name whatever_alert?
what is ScheduledView_mypdf, it also looks like an alert ?

Where is whatever_alert used in the script?
!/bin/bash
curl -k -u admin:password https://localhost:8089/servicesNS/admin/search/saved/searches/_ScheduledView__mypdf/dispatch -d trigger_actions=1
How does splunk server know that whatever_alert needs to be called for this ScheduledView_mypdf?

I need to do all these using Splunk Java SDK. Any step by step instruction on how to do this will be appreciated. Thanks in advance!

0 Karma

Kyle_Jackson
Explorer

This works!

PDF TRIGGER

[whatever_alert]
action.script = 1
action.script.filename = whatever_pdf_trigger.sh
cron_schedule = */10 * * * *
dispatch.earliest_time = -2m@m
dispatch.latest_time = now
displayview = flashtimeline
enableSched = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=ops | head 2

PDF

[_ScheduledView__mypdf]
action.email = 1
action.email.maxtime = 60m
action.email.paperorientation = portrait
action.email.papersize = letter
action.email.pdfview = mypdf
action.email.sendpdf = 1
action.email.to = your_email@youraddress.com
action.email.ttl = 10
cron_schedule = */5 * * * *
description = scheduled search for view name=mypdf
dispatch.earliest_time = 1
dispatch.latest_time = 2
enableSched = 0
is_visible = 0
search = | noop

Script:

!/bin/bash
curl -k -u admin:password https://localhost:8089/servicesNS/admin/search/saved/searches/_ScheduledView__mypdf/dispatch -d trigger_actions=1

josemanm12
Engager

Could you share the script ?

0 Karma

Kyle_Jackson
Explorer

If that user expires because they leave the company, then what? Is there a caveat to using admin?

0 Karma

chris
Motivator

It might be a good idea to use a different user than admin. If you do the url changes to:
https://localhost:8089/servicesNS/my_user/search/saved/searches/_ScheduledView__mypdf/dispatch -d trigger_actions=1

0 Karma

wlouisharris
New Member

Very nice - this works great.

0 Karma

vincesesto
Communicator

one more try to see if anyone has any ideas?

0 Karma

vincesesto
Communicator

Sorry, just to clarify this a bit further, the view I have set up is complex and has a lot of graphs, etc. So it is not something that I can run as a search and then use sendemail. I am wanting to generate the pdf from the html page and then forward this pdf onto an email address, similar to using a scheduled search but I need to be able to trigger it from a script

0 Karma
Get Updates on the Splunk Community!

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...