Deployment Architecture

Why are embedded reports from a search head cluster sometimes blank?

Olivier44
Explorer

Hello,

I made a web page with 4 embedded reports from Splunk. The reports are scheduled every 5 minutes and the web page reload itself every 1 minute. The embedded reports are pointing to one search head which is in a search head cluster.

My problem is that sometimes, some reports are blank, but the others are good!

Anyone has an idea of where is the problem ?

Thanks

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

The scheduled report runs randomly on one of the search heads on the cluster. So it might not be on the search head where you have set the embedding. On top of that there was a bug in splunk which affects the behavior but this is fixed in 6.3

Also remember to set the embedSecret = in server.conf .

Details are

When using report embedding, normally the generated URLs can only
  be used on the search head they were generated on
* If "embedSecret" is set, then the token in the URL will be encrypted
  with this key.  Then other search heads with the exact same setting
  can also use the same URL.
* This is needed if you want to use report embedding across multiple
  nodes on a search head pool.

I'm running a search head cluster with url loadbalancing and embedded report works fine there.

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

The scheduled report runs randomly on one of the search heads on the cluster. So it might not be on the search head where you have set the embedding. On top of that there was a bug in splunk which affects the behavior but this is fixed in 6.3

Also remember to set the embedSecret = in server.conf .

Details are

When using report embedding, normally the generated URLs can only
  be used on the search head they were generated on
* If "embedSecret" is set, then the token in the URL will be encrypted
  with this key.  Then other search heads with the exact same setting
  can also use the same URL.
* This is needed if you want to use report embedding across multiple
  nodes on a search head pool.

I'm running a search head cluster with url loadbalancing and embedded report works fine there.

Happy Splunking!
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...