Read more about custom chart components at http://dev.splunk.com/view/webframework/SP-CAAAER6 and try the web framework toolkit app for examples ... View more

I think what you are looking for is bucket (or span attribute for timechart) command. This will allow you to control the granularity what each bar stands for. ... View more

is your splunk search head part of "log on to" computer group? ... View more

It works fine for me. Could you share your dashboard xml? ... View more

0range, not all simpleXml formatting is supported by integrated PDF. Read more - use Integrated PDF and known issues ... View more

Not possible out of the box. However, as a quick workaround, create a 5th dashboard which is the combination of all four dashboard and generate PDF alerting for 5th dashboard. ... View more

Height parameter is not supported for integrated PDF yet. ... View more

For free license mode you do not need to perform authentication. Simply update the iframe src to the view uri. In your case, it would look something like <iframe src="http://splunk:8000/app/search/SST_DB_STATS_LFW" ... ... View more

You could be hitting pdfreport server app page timeout, defaults to 180 seconds. Splunk will wait for dashboard's print ready event or timeout event to occur, which ever happens first, to actually generate PDF. In your case it could be that it takes more than 180s to generate your 50 pager thereby resulting in empty modules in pdfs. Try to update this firefox_timeout config in $SPLUNK_HOME/etc/apps/pdfserver/local/pdf_server.conf file to a larger number, equivalent to time in seconds it will take to load the complete page. ... View more

Neither 4.3.* or 5.0.* support roles based timeout. You can update timeout for overall configuration as described in the above link. ... View more

As a workaround - 1. Try to ensure such charts on dashboard have a row by themselves. This will allow the chart to cover as much width as it can. For ex. expand the 500px to 600px. 2. Reduce the number of points you are plotting by increasing the span from 15m to say 30m. This is a bug, and we will work on improving the messaging. ... View more

I see. The issue is overflow on the x-axis does not alert the user. The issue here is the size of the chart of smaller than the actual number of points it tries to plot on it. For example: you size of the chart is 500px, but the sum of all the points you are tying to plot is 800px. As a result, you can see the first 500px but the remaining 300px are hidden. ... View more

The only viable solution could be - Shorten the labels: 25,000,000,000 bytes ~ 25Gigabytes (=23.2gb). Keep 1 chart per row. This will allow for more space for the labels. What would be an acceptable solution for you? ... View more

By default splunk disables field extractions for certain fields. One of these fields, eventtype, is used by custom event render. I would update the search to include '...| fields eventtype' field and you should have the custom rendering working. ... View more

Including or excluding the splunk logo from pdf is the only configuration available for integrated pdf generation. This can be achieved using reportIncludeSplunkLogo in alert_actions.conf learn more about specs here. To include custom logo, you will have to modify python code. NOTE: this is risky, not supported and will be overwritten upon upgrade. Step 1. You will need to come up with an SVG for your logo Step 2. Modify $SPLUNK_HOME/lib/python2.7/site-packages/splunk/pdf/pdfrenderer.py file. At the end of the file, change the variable assignment of __splunkLogoSvg_ to your new logo. Step 3. Restart Splunk and generate the PDF with the new logo design. ... View more

What does the job inspector say? I would compare job inspectors of the search in production vs search in dev instance. Here are docs for using job description. I would also try to change the multiline search to one line, just to test. ... View more

You can configure session timeout as described in docs. However this is overall configuration for all users. 5.0.x does not support roles based session timeouts. ... View more

From Adobe font X package description Adobeﾮ Readerﾮ X Font Packs enable you to display and interact with documents authored in languages other than those supported in your native Adobe Reader software Splunk out of the box has support for Helvetica and CJK CID font sets. I am assuming you are generating a pdf which include one of these fonts and adobe reader is missing that font. You could either install the adobe font pack or make sure you exclude results containing non support font from the pdf. ... View more

From the error: seems like the results table is too large to fit on page. The result table has 564 rows x 7 cols and probably its size is 423x1260 pixels. If you dont mind, can you share the data or a screen shot of what is expected? ... View more