Reporting

When trying to schedule a pdf email delivery I receive the following error: "In handler 'scheduledviews': Could not find writer..."

Communicator

Full error is

In handler 'scheduledviews': Could not find writer for: /<user.name>/<app.name>/savedsearches/_ScheduledView__<dashboard.name> [0] [D:\Program Files\Splunk\etc]

Test email and pdf generation works fine. Even though the error is returned the email addresses still show under More info > Schedule but after a refresh are gone.

What is going on here?


I found the source of my issue in splunkd.log. There was a case difference between the deployed app and the app folder under my username.

05-27-2014 12:07:15.208 -0500 WARN BundlesUtil - D:\Program Files\Splunk\etc\users\<user.name>\<APP.NAME>\history already exists but with different casing: D:\Program Files\Splunk\etc\users\<user.name>\<app.name>\history

Now however, after fixing the case issue and restarting Splunk I am seeing some more issues with PDF scheduling.

  • When I create a Scheduled PDF delivery there are almost no values defined in savedsearches.conf the action.email.to field is filled and the cron_schedule field but that's it. I am expecting to see a whole bunch of key/values here.
  • When I create a new PDF delivery schedule it overwrites the existing one
  • When I try to change permissions on the saved search I get
    • Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'type': 'ERROR', 'text': 'Cannot overwrite existing app object', 'code': None}]
    • splunkd says 05-27-2014 13:33:09.736 -0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications

So after removing all PDF schedules for that dashboard I was able to create a new one correctly and change its permissions, but subsequently created PDF delivery schedules still return the error above. Is this behavior expected?

1 Solution

SplunkTrust
SplunkTrust

http://answers.splunk.com/answers/56747/could-not-find-writer

I found that if you look at either internal index or the local splunkd.log, there's probably going to be more detail. In my case, it was a file permissions issue writing to $SPLUNKHOME/etc/users/. Yours might be different.

View solution in original post

SplunkTrust
SplunkTrust

http://answers.splunk.com/answers/56747/could-not-find-writer

I found that if you look at either internal index or the local splunkd.log, there's probably going to be more detail. In my case, it was a file permissions issue writing to $SPLUNKHOME/etc/users/. Yours might be different.

View solution in original post

Communicator

Ah, yes I found my answer in splunkd.log. There was a case difference between the deployed app and the app folder under my username.

Now however, after fixing the case issue and restarting Splunk I am seeing even more issues with PDF scheduling. I will update the body.

0 Karma