Reporting

Why is dashboard "Schedule PDF Delivery" receiving wrong empty result (search custom fields)?

ybartel
New Member

We are on Splunk Enterprise 8.0.2 (just updated from v6 - problem occured there too).

Dashboard and manually "Export PDF" prints correct results, but "Schedule PDF Delivery" prints wrong empty data.
But converting the exact same search phrase into a report and in the dashboard, instead, references to the report and prints correct data scheduled!

this fails scheduled:

<search><query>index=$idx$ ExecEdScAbverkaeufe::true | stats count</query><earliest>@d-3d</earliest><latest>@d-2d</latest></search>

(ExecEdScAbverkaeufe is a custom field)

but this is working scheduled:

<search ref="depot_status_DESADVEd"></search>
Labels (2)
0 Karma

cmerriman
Super Champion

I haven't done this in a while, so it might not be true for v8*, however I recall in v6* there was an issue with schedule PDFs that took too long to run. The PDF would render empty panels if the search ran for an extended period of time. How long does your search typically take to run?
Found the doc on this:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DashboardPDFs#Configure_the_timeout_setting_f...

default is 1h in limits.conf, not sure if your env. has the default limit or another limit set. Something you could look into to see if that's the reason?

0 Karma

ybartel
New Member

thank you for your answer! Our search just takes a couple of seconds though.
render_endpoint_timeout isnt specified in our limits.conf, so the default should be allright, right?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...