About gareth

gareth · ‎02-03-2012

Yes - You can setup Splunk on a Linux box and install the PDF app into it (after ensuring all the requirements are met to run the app on Linux as per the documentation). You can then configure your Windows Splunk server to use the Linux Splunk server to generate PDF reports as documented at http://docs.splunk.com/Documentation/Splunk/latest/Installation/ConfigurePDFprintingforSplunkWeb#Enable_PDF_printing_on_a_search_head eg. if your Linux server's IP address is 10.1.2.3 then you would enter https://10.1.2.3:8089/ into the "Remote PDF Server URL" field on your Windows server. That should be all that's required - You don't need to do anything further to the copy of Splunk on the Linux server as the PDF app will automatically use the Windows server to run the search and collect the data for the report.

gareth · ‎07-06-2011

I've used splunkweb with wildcard certificates before with no problems - Have you tried accessing it with openssl to see if that reveals any more specific information? Also check web_service.log to confirm that it's loaded the certificate without error openssl s_client -connect hostname:port

gareth · ‎04-09-2011

Well even with that traffic, the lock files shouldn't be months old; something odd there.

gareth · ‎04-07-2011

No, that shouldn't happen. Extraneous session and lock files should be purged every five minutes or so. Which version of Splunk are you running (and on what platform)? Are there any related error messages in the web_service.log?

gareth · ‎04-07-2011

Double check that the "Link hostname" field in Manager » System settings » Email alert settings is the IP address or hostname of the search head.

gareth · ‎04-04-2011

Unfortunately it's not possible in the current version of Splunk without modifying code

gareth · ‎04-02-2011

Do you have/can you get a pcap dump from tcpdump of traffic to/from port 80 from the machine Splunk is running on?

gareth · ‎03-18-2011

That output is odd and unexpected - It would if you could contact support and supply: The python.log with debug enabled - Edit $SPLUNK_HOME/etc/log.cfg and change "splunk = INFO" to "splunk = DEBUG" at the bttom of the file; no restart is required. The version of CentOS you're running The version of Splunk you're running A list of installed packages from running rpm -qa It would also be useful to know if you experience the same result with SSL turned off on the search head.

gareth · ‎03-09-2011

The web_service.log should record the nature of the internal service error that you're seeing in python.log

gareth · ‎03-07-2011

Right - We are intending to add an extra field to address this issue in a future release. In the interim you can point it at Apache can configure Apache to pass through requests from the Splunk IP address to Splunk without requiring authentication - Splunk 4.1.7 should work correctly with that setup.

gareth · ‎03-04-2011

The SPL is indeed the issue I was referring too; that addresses the authentication issue when the PDF app is communicating directly with an SSO enabled search head. The library error you're seeing implies that you're running an older 64 bit Linux distribution that has glib 2.3 or earlier. The 64 bit version of Flash requires glibc 2.4 or later. Your options are to either upgrade to glibc 2.4 if your distribution provides it, use an alternate, more up to date machine or possibly install 32 bit compatibility libraries (flash for 32 bit works with older versions of glibc)

gareth · ‎03-04-2011

There's a couple of issues here. First there's a bug that causes the PDF app not to authenticate correctly with SSO unless you're running Splunk version 4.1.7 or later. Secondly Splunk currently uses the "Link hostname" field in Manager -> System Settings -> Email Alert Settings to determine which hostname to connect to to generate the report to render. It needs to bypass the authentication checks your Apache user is making as it has no way of knowing what credentials it expects. Setting the link hostname to the explicit hostname:port or ip address of the search head will accomplish that, else you can add a rule to your Apache configuration to allow connections from the PDF server IP address to be forwarded directly to the search head.

gareth · ‎02-08-2011

Can you supply some information on which version of Splunk you're using, which version of the pdf app and what errors you're receiving? Also are you using a Splunk-generated SSL certificate or are you supplying your own?

gareth · ‎02-04-2011

As you're using Apache 2.x you should remove the "tools.proxy.on = True" line from web.conf In server.conf trustedIP only needs to be set to 127.0.0.1 (since splunkweb and splunkd are on the same machine) Other than that it looks good

gareth · ‎12-03-2010

If the REMOTE_USER isn't being passed through, try replacing the RequestHeader line with the following: RewriteEngine On RewriteCond %{LA-U:REMOTE_USER} (.+) RewriteRule . - [E=RU:%1] RequestHeader set REMOTE_USER %{RU}e You may also have to set the remoteUser setting in web.conf to "REMOTE-USER" (dash rather than underscore): web.conf: [settings] trustedIP = 127.0.0.1 remoteUser = REMOTE-USER

gareth · ‎08-25-2010

I'm not sure how the profile could end up with proxy settings - the PDF app creates a temporary home directory, a fresh profile and strips environment variables (such as http_proxy) every time, before starting Firefox. It also primes Firefox with relevant SSL certificate overrides so none of this should be necessary. I'd love to hear from you if you have insight as to what was going wrong with the setup.

gareth · ‎08-10-2010

Thanks for the update - I've modified the docs accordingly - libxcursor1 shouldn't be required though (at least, it wasn't during my tests)

gareth · ‎08-04-2010

I haven't seen it fail at this point before - Which version of Ubuntu are you running exactly? I''ll try and reproduce it here

gareth · ‎07-22-2010

The log indicates that it's trying to contact splunkd without SSL (http://127.0.0.1:8089/services/pdfserver/renderpdf instead of https://...) - Unless you've actually configured splunkd to not use SSL (which isn't generally recommended) then you should check that the "Remote PDF Report Server URL" setting in Manager->System Settings->Email Alert Settings is blank. If you actually want to use a remote PDF server then that field should be set to https://servername:8089/

gareth · ‎06-23-2010

Unfortunately this is a known issue with the current version of the PDF server app - A new version will be released shortly that addresses the problem when used in conjunction with the latest version of Splunk. Thanks for your patience!

Posts	25
Solutions	9
Karma Given	5
Karma Received	34
Member Since	‎04-08-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Re: PDF report with windows indexer

Re: Are wildcard certificates supported with Splun...

Re: Session lock files

Re: Session lock files

Re: aborting PDF generation

Re: is it possible to change the name of the PDF r...

Re: NAT IP causes certain searches to crash Cherry...

Re: Saved Searches fail to generate PDF attachment...

Re: Reports scheduled for PDF delivery are not get...

Re: How to get PDF server works with SSO?

Re: How to get PDF server works with SSO?

Re: How to get PDF server works with SSO?

Re: SSL enabled splunk working with pdf server

Re: SSO with Apache - Splunk detecting browser IP ...

Re: How do I make Single Sign On work with mod_pro...

Re: PDFServer cant contact appserver: Proxy Authen...

Re: pdf_server error Execution of Firefox to creat...

Re: pdf_server error Execution of Firefox to creat...

Re: PDF Server timing out during scheduled dashboa...

Re: PDF-server : aborting PDF generation