Why is dashboard "Schedule PDF Delivery" receiving wrong empty result (search custom fields)?

New Member

We are on Splunk Enterprise 8.0.2 (just updated from v6 - problem occured there too).

Dashboard and manually "Export PDF" prints correct results, but "Schedule PDF Delivery" prints wrong empty data.
But converting the exact same search phrase into a report and in the dashboard, instead, references to the report and prints correct data scheduled!

this fails scheduled:

<search><query>index=$idx$ ExecEdScAbverkaeufe::true | stats count</query><earliest>@d-3d</earliest><latest>@d-2d</latest></search>

(ExecEdScAbverkaeufe is a custom field)

but this is working scheduled:

<search ref="depot_status_DESADVEd"></search>
Labels (2)
0 Karma

Super Champion

I haven't done this in a while, so it might not be true for v8*, however I recall in v6* there was an issue with schedule PDFs that took too long to run. The PDF would render empty panels if the search ran for an extended period of time. How long does your search typically take to run?
Found the doc on this:

default is 1h in limits.conf, not sure if your env. has the default limit or another limit set. Something you could look into to see if that's the reason?

0 Karma

New Member

thank you for your answer! Our search just takes a couple of seconds though.
render_endpoint_timeout isnt specified in our limits.conf, so the default should be allright, right?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...