We installed wildcard certificates on our search heads (*.company.com) issued by "Trusted Secure Certificate Authority" this weekend (good 8/8/12- 8/9/15) and the PDF server stopped working. Web browsers (IE/Firefox/chrome) have no issues with the certificate using the splunk web GUI.
PDF server 1.3 (re-downloaded today).
PDF server is on local search head
The error in the PDF email is:
An error occurred while generating a PDF of this report:
Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 13:03:30,644 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch requestXml = et.fromstring(requestInfo)
File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 13:03:30,738 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 13:03:30,738 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763...  sessionSource=direct
2012-09-04 13:03:30,817 DEBUG simpleRequest < server responded status=200 responseTime=0.0781s
2012-09-04 13:03:30,817 DEBUG getStatus - elapsed=0.0789680480957 nextRetry=0.0500039395281
2012-09-04 13:03:31,248 INFO Sending email. subject="Splunk Alert: test_head1000" , results_link="https://lab.company.com:443/app/search/@go?sid=scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763600_416e77d67eeee6a0", recepients="['firstname.lastname@example.org']"
We had it too when we were at v.4.3
Could not make it work, even with Splunk Support.
Ended up sacrificing SSL in favor of PDF.
Now we're on v.5.0.5 and have no issues, but the PDF mechanism has changed in v.5 completely.