Reporting

Why is dashboard "Schedule PDF Delivery" receiving wrong empty result (search custom fields)?

ybartel
New Member

We are on Splunk Enterprise 8.0.2 (just updated from v6 - problem occured there too).

Dashboard and manually "Export PDF" prints correct results, but "Schedule PDF Delivery" prints wrong empty data.
But converting the exact same search phrase into a report and in the dashboard, instead, references to the report and prints correct data scheduled!

this fails scheduled:

<search><query>index=$idx$ ExecEdScAbverkaeufe::true | stats count</query><earliest>@d-3d</earliest><latest>@d-2d</latest></search>

(ExecEdScAbverkaeufe is a custom field)

but this is working scheduled:

<search ref="depot_status_DESADVEd"></search>
Labels (2)
0 Karma

cmerriman
Super Champion

I haven't done this in a while, so it might not be true for v8*, however I recall in v6* there was an issue with schedule PDFs that took too long to run. The PDF would render empty panels if the search ran for an extended period of time. How long does your search typically take to run?
Found the doc on this:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DashboardPDFs#Configure_the_timeout_setting_f...

default is 1h in limits.conf, not sure if your env. has the default limit or another limit set. Something you could look into to see if that's the reason?

0 Karma

ybartel
New Member

thank you for your answer! Our search just takes a couple of seconds though.
render_endpoint_timeout isnt specified in our limits.conf, so the default should be allright, right?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.