Splunk Search

Splunk PDF export issue with "empty" pdf

flo_cognosec
Communicator

Actually the view below shows "No results found." in the browser by opening the view and as soon as I try to generate a pdf I get an empty graph with just the two axis shown.
(Printing the View and THEN exporting it to pdf works, so the web "output" is def. fine)
I would like to get rid of the graph with the axis and get a result in the pdf as in the web-gui: No results found.

How to either exclude an empty report from the pdf generation or output the fact that no data matches the query ?

Splunk Vers. 5.0.1
PDF Server for Linux 1.2
Sideview Utils 1.3.5
Search 5.0.1

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Report</label>
  <row>
    <chart>
      <searchString>index="summary" event="failed_log" | timechart fixedrange=True sum(count) by user</searchString>
      <title>Failed Login</title>
      <earliestTime>-1m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisLabelsY.majorUnit">1</option>
      <option name="charting.axisTitleX.text">time</option>
      <option name="charting.axisTitleY.text">count</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.layout.splitSeries">false</option>
      <option name="charting.legend.placement">right</option>
    </chart>
  </row>
</dashboard>
0 Karma
1 Solution

jayannah
Builder

This the limitation in the Splunk. Not supported in the latest version aswell.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/DashboardPDFs

View solution in original post

jayannah
Builder

This the limitation in the Splunk. Not supported in the latest version aswell.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/DashboardPDFs

flo_cognosec
Communicator

Update

This seems to be a bug in splunk. At least that's what I got in an support email.
So if this happens to you, update to a later version of splunk

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Introducing the 2026 - 2027 SplunkTrust cohort!

The goal of the SplunkTrust™ membership has historically been to acknowledge and recognize those who go above ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...