I have worked on a query in order to generate a report that gives us the monthly visits and bandwidth used etc. I have listed the query below. It gives the results in the splunk environment. But when we generate a PDF document we see the error listed below the query, after the results table. I would appreciate suggestions to resolve this issue.
|rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)"
|rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)"
|rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)"
|timechart span=1mon@mon dc(reqip) as "Unique Visitors", dc(uri) as Pages, sum(bytes) as Bandwidth(KB), count(uri) as Hits
|eval Bandwidth(KB) = round('Bandwidth(KB)'/1024,2)
|append [search index="med" sourcetype="med:httpaccess:log" *med.cms.gov*
|rex field=_raw "(\"|)(?<server_ip>\d+\.\d+\.\d+\.\d+)\s+(?<reqip>\d+\.\d+\.\d+\.\d+)"
|rex field=_raw "(?<uri>\s+[\w\d\/\.]+-\S+)"
|rex field=_raw "\s(?<status>\d+)\s(?<bytes>\d+)"
|bin span=1mon@mon _time
|stats count(uri) as viewed by _time, reqip
|stats sum(viewed) as "Number of Visits" by _time] |stats values(*) as * by _time
|fillnull
|addcoltotals label="Total" labelfield="_time"
|table _time "Unique Visitors" "Number of Visits" Pages Hits Bandwidth(KB)
The expected result is
