Actually the view below shows "No results found." in the browser by opening the view and as soon as I try to generate a pdf I get an empty graph with just the two axis shown.
(Printing the View and THEN exporting it to pdf works, so the web "output" is def. fine)
I would like to get rid of the graph with the axis and get a result in the pdf as in the web-gui: No results found.
How to either exclude an empty report from the pdf generation or output the fact that no data matches the query ?
Splunk Vers. 5.0.1
PDF Server for Linux 1.2
Sideview Utils 1.3.5
Search 5.0.1
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>Report</label>
<row>
<chart>
<searchString>index="summary" event="failed_log" | timechart fixedrange=True sum(count) by user</searchString>
<title>Failed Login</title>
<earliestTime>-1m@m</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleX.text">time</option>
<option name="charting.axisTitleY.text">count</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.layout.splitSeries">false</option>
<option name="charting.legend.placement">right</option>
</chart>
</row>
</dashboard>
This the limitation in the Splunk. Not supported in the latest version aswell.
http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/DashboardPDFs
This the limitation in the Splunk. Not supported in the latest version aswell.
http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/DashboardPDFs
Update
This seems to be a bug in splunk. At least that's what I got in an support email.
So if this happens to you, update to a later version of splunk