the "pdfserver" times out with "Error 500"

[shirolu]

The problem is with the "pdfserver" module.

Our saved search generates results of around 1,000 to 10,000+ events and in order to print all the events into a single page, we have a modified version of "flashtimeline" so that all events will be shown on the single page.

However, the problem is that the "pdfserver" times out with "Error 500" when run. We have tried increasing the timeout period for the pdfserver from 5 to 10 to 15 minutes (firefox_timeout = 900) but with no success.

We did a test of a little over 1000 events with a timeout period of 5 minutes and it runs ok. Then, we increased the events to 2000 and a timeout period of 10 minutes and theoretically it should be fine. However the "timeout" problem surfaces.

Regards and thank you,

Shiro Lu.

[Simeon]

It sounds like there may be one of two problems.

1. The pdfserver may not be able to render the pdf
2. The Splunk server is not delivering the search result to the pdf server

For issue 1, I would double check the error to make sure it is truly a timeout issue and not a local firefox process issue. Does firefox have proper resources to render the pdf?

For issue 2, it is possible that the search is timing out internally. I would check to see how long the search takes to run and see if it is hitting some sort of limit internally. Also, sending a 10k event result might be hitting another limit depending on your search.

The following debugging page might be helpful:

http://www.splunk.com/wiki/Community:TroubleshootingPDFServer