Reporting

Why is dashboard "Schedule PDF Delivery" receiving wrong empty result (search custom fields)?

ybartel
New Member

We are on Splunk Enterprise 8.0.2 (just updated from v6 - problem occured there too).

Dashboard and manually "Export PDF" prints correct results, but "Schedule PDF Delivery" prints wrong empty data.
But converting the exact same search phrase into a report and in the dashboard, instead, references to the report and prints correct data scheduled!

this fails scheduled:

<search><query>index=$idx$ ExecEdScAbverkaeufe::true | stats count</query><earliest>@d-3d</earliest><latest>@d-2d</latest></search>

(ExecEdScAbverkaeufe is a custom field)

but this is working scheduled:

<search ref="depot_status_DESADVEd"></search>
Labels (2)
0 Karma

cmerriman
Super Champion

I haven't done this in a while, so it might not be true for v8*, however I recall in v6* there was an issue with schedule PDFs that took too long to run. The PDF would render empty panels if the search ran for an extended period of time. How long does your search typically take to run?
Found the doc on this:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DashboardPDFs#Configure_the_timeout_setting_f...

default is 1h in limits.conf, not sure if your env. has the default limit or another limit set. Something you could look into to see if that's the reason?

0 Karma

ybartel
New Member

thank you for your answer! Our search just takes a couple of seconds though.
render_endpoint_timeout isnt specified in our limits.conf, so the default should be allright, right?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...