It sounds like there may be one of two problems. The pdfserver may not be able to render the pdf The Splunk server is not delivering the search result to the pdf server For issue 1, I would double check the error to make sure it is truly a timeout issue and not a local firefox process issue. Does firefox have proper resources to render the pdf? For issue 2, it is possible that the search is timing out internally. I would check to see how long the search takes to run and see if it is hitting some sort of limit internally. Also, sending a 10k event result might be hitting another limit depending on your search. The following debugging page might be helpful: http://www.splunk.com/wiki/Community:TroubleshootingPDFServer ... View more

After checking with Splunk's log, the saved search in question only took less than 10 seconds to complete. The result csv file is 849 KB in size and contains about 6k of events. I no longer think the timeout is caused by search running too long. ... View more

it's better to accept or upvote the answer rather than posting a second answer saying your issue has been solved. ... View more

No answer here - I have the same question. I changed the date range through the custom time dropdown box and that works. It gives me events in the correct date range, but not the correct time range. I then added the modifiers below to the query and I get no results. date_hour>9 date_hour<18 Any suggestions? Trying to limit my search to the previous 5 days between 5am and 9am. I can get the previous 5 days through the dropdown box but I am unable to limit the time range. ... View more