Splunk Search

Dashboard PDF email failing

A dashboard will export to PDF correctly, but anytime we try to send it via email (be it a test email or scheduled) no email is sent and we see the following internal log entry. This was working for many months (years?) and suddenly stopped working. And is true for any/all dashboards we have created.

2019-04-25 12:00:00,368 -0400 WARNING   sendemail:1398 - search results is empty, no email will be sent
host =       source = /apps/splunk/var/log/splunk/python.log      sourcetype = splunk_python

Splunk Enterprise
Version:
7.2.6
Build:
c0bf0f679ce9

0 Karma
1 Solution

Engager

The same problem occured for me. Workaround for this problem was to exchange the sendemail.py version. I used the sendemail.py version from Splunk 7.2.0 with full path: /etc/apps/search/bin/sendemail.py. Dashboard email sending working as usual afterwards.,

View solution in original post

Explorer

I can confirm this was fixed in 7.3.0.
Yes the changelog does not contains this bugfix, which is rather unprofessional in my optinion.
This thread can be closed.

0 Karma

Path Finder

We were having this problem with 7.2.6, and the issue was resolved with the 7.3 update -- though I could not find any reference to it in the release notes.

The contents of the sendemail.py program look markedly different, so obviously a lot of code therein was touched by this update.

Just glad it's working again,
Aaron

Explorer

solution if you do not have the old version:

  1. create backup of /opt/splunk/etc/apps/search/bin/sendemail.py
  2. open /opt/splunk/etc/apps/search/bin/sendemail.py (Splunk 7.2.6) with a editor as a user with write permissions.
  3. remove line 1398 "logger.warn("search results is empty, no email will be sent")"
  4. remove line 1397 "else:"
  5. remove 4 spaces at the start of lines 1393-1396 (if, results=,else,results=)
  6. remove line 1392 "if results:"
  7. save file
  8. test
0 Karma

Explorer

Splunk Support:

I understand that your PDF scheduled from dashboards are no longer working on 7.2.6. I confirmed this is a known issue and we are actively working on finding a solution for it.

We have found two possible workarounds:
- Replace sendemail.py from 7.2.6 with the same file in your older version.
- Edit your saved search, in the "Search" field replace "| noop" with "| makeresults".

For the moment, the issue is still unresolved.

0 Karma

Explorer

I have the same error.
Splunk 7.2.6
When sending Dashboard as pdf via mail (scheduled or with "send test email" command):
2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results is empty, no email will be sent

When i open the Dashboard in Splunk i see that it is not empty...

0 Karma

Explorer

Hello,

I have the same issue, which appears to be introduced in 7.2.6, as email PDF delivery was working prior to upgrade.

I'd like to try the workaround, however am slightly confused as where to find the sendemail.py version from Splunk 7.2.0 ? Do I need install 7.2.0 and extract sendemail.py or is there an archive somewhere I could pull it from?

Thanks for your help!

Jordan

0 Karma

Engager

The same problem occured for me. Workaround for this problem was to exchange the sendemail.py version. I used the sendemail.py version from Splunk 7.2.0 with full path: /etc/apps/search/bin/sendemail.py. Dashboard email sending working as usual afterwards.,

View solution in original post

Splunk Employee
Splunk Employee

Does this workaround apply for 7.2.9 as well?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!