Dashboard PDF email failing

[elumpkin_caisgr]

A dashboard will export to PDF correctly, but anytime we try to send it via email (be it a test email or scheduled) no email is sent and we see the following internal log entry. This was working for many months (years?) and suddenly stopped working. And is true for any/all dashboards we have created.

2019-04-25 12:00:00,368 -0400 WARNING   sendemail:1398 - search results is empty, no email will be sent
host =       source = /apps/splunk/var/log/splunk/python.log      sourcetype = splunk_python

Splunk Enterprise
Version:
7.2.6
Build:
c0bf0f679ce9

[dfgrtKJH]

I can confirm this was fixed in 7.3.0.
Yes the changelog does not contains this bugfix, which is rather unprofessional in my optinion.
This thread can be closed.

[aaron_sakovich]

We were having this problem with 7.2.6, and the issue was resolved with the 7.3 update -- though I could not find any reference to it in the release notes.

The contents of the sendemail.py program look markedly different, so obviously a lot of code therein was touched by this update.

Just glad it's working again,
Aaron

[dfgrtKJH]

solution if you do not have the old version:

1. create backup of /opt/splunk/etc/apps/search/bin/sendemail.py
2. open /opt/splunk/etc/apps/search/bin/sendemail.py (Splunk 7.2.6) with a editor as a user with write permissions.
3. remove line 1398 "logger.warn("search results is empty, no email will be sent")"
4. remove line 1397 "else:"
5. remove 4 spaces at the start of lines 1393-1396 (if, results=,else,results=)
6. remove line 1392 "if results:"
7. save file
8. test

[dfgrtKJH]

Splunk Support:

I understand that your PDF scheduled from dashboards are no longer working on 7.2.6. I confirmed this is a known issue and we are actively working on finding a solution for it.

We have found two possible workarounds:
- Replace sendemail.py from 7.2.6 with the same file in your older version.
- Edit your saved search, in the "Search" field replace "| noop" with "| makeresults".

For the moment, the issue is still unresolved.

[dfgrtKJH]

I have the same error.
Splunk 7.2.6
When sending Dashboard as pdf via mail (scheduled or with "send test email" command):
2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results is empty, no email will be sent

When i open the Dashboard in Splunk i see that it is not empty...

[JAvnaim]

Hello,

I have the same issue, which appears to be introduced in 7.2.6, as email PDF delivery was working prior to upgrade.

I'd like to try the workaround, however am slightly confused as where to find the sendemail.py version from Splunk 7.2.0 ? Do I need install 7.2.0 and extract sendemail.py or is there an archive somewhere I could pull it from?

Thanks for your help!

Jordan

[gailuh · Accepted solution]

The same problem occured for me. Workaround for this problem was to exchange the sendemail.py version. I used the sendemail.py version from Splunk 7.2.0 with full path: /etc/apps/search/bin/sendemail.py. Dashboard email sending working as usual afterwards.,

[saramamurthy_sp]

Does this workaround apply for 7.2.9 as well?