Reporting

When trying to schedule a pdf email delivery I receive the following error: "In handler 'scheduledviews': Could not find writer..."

neiljpeterson
Communicator

Full error is

In handler 'scheduledviews': Could not find writer for: /<user.name>/<app.name>/savedsearches/_ScheduledView__<dashboard.name> [0] [D:\Program Files\Splunk\etc]

Test email and pdf generation works fine. Even though the error is returned the email addresses still show under More info > Schedule but after a refresh are gone.

What is going on here?


I found the source of my issue in splunkd.log. There was a case difference between the deployed app and the app folder under my username.

05-27-2014 12:07:15.208 -0500 WARN BundlesUtil - D:\Program Files\Splunk\etc\users\<user.name>\<APP.NAME>\history already exists but with different casing: D:\Program Files\Splunk\etc\users\<user.name>\<app.name>\history

Now however, after fixing the case issue and restarting Splunk I am seeing some more issues with PDF scheduling.

  • When I create a Scheduled PDF delivery there are almost no values defined in savedsearches.conf the action.email.to field is filled and the cron_schedule field but that's it. I am expecting to see a whole bunch of key/values here.
  • When I create a new PDF delivery schedule it overwrites the existing one
  • When I try to change permissions on the saved search I get
    • Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'type': 'ERROR', 'text': 'Cannot overwrite existing app object', 'code': None}]
    • splunkd says 05-27-2014 13:33:09.736 -0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications

So after removing all PDF schedules for that dashboard I was able to create a new one correctly and change its permissions, but subsequently created PDF delivery schedules still return the error above. Is this behavior expected?

1 Solution

jkat54
SplunkTrust
SplunkTrust

http://answers.splunk.com/answers/56747/could-not-find-writer

I found that if you look at either _internal index or the local splunkd.log, there's probably going to be more detail. In my case, it was a file permissions issue writing to $SPLUNK_HOME/etc/users/. Yours might be different.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

http://answers.splunk.com/answers/56747/could-not-find-writer

I found that if you look at either _internal index or the local splunkd.log, there's probably going to be more detail. In my case, it was a file permissions issue writing to $SPLUNK_HOME/etc/users/. Yours might be different.

neiljpeterson
Communicator

Ah, yes I found my answer in splunkd.log. There was a case difference between the deployed app and the app folder under my username.

Now however, after fixing the case issue and restarting Splunk I am seeing even more issues with PDF scheduling. I will update the body.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...