Deployment Architecture

Why are embedded reports from a search head cluster sometimes blank?

Olivier44
Explorer

Hello,

I made a web page with 4 embedded reports from Splunk. The reports are scheduled every 5 minutes and the web page reload itself every 1 minute. The embedded reports are pointing to one search head which is in a search head cluster.

My problem is that sometimes, some reports are blank, but the others are good!

Anyone has an idea of where is the problem ?

Thanks

0 Karma
1 Solution

renjith_nair
Legend

The scheduled report runs randomly on one of the search heads on the cluster. So it might not be on the search head where you have set the embedding. On top of that there was a bug in splunk which affects the behavior but this is fixed in 6.3

Also remember to set the embedSecret = in server.conf .

Details are

When using report embedding, normally the generated URLs can only
  be used on the search head they were generated on
* If "embedSecret" is set, then the token in the URL will be encrypted
  with this key.  Then other search heads with the exact same setting
  can also use the same URL.
* This is needed if you want to use report embedding across multiple
  nodes on a search head pool.

I'm running a search head cluster with url loadbalancing and embedded report works fine there.

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

The scheduled report runs randomly on one of the search heads on the cluster. So it might not be on the search head where you have set the embedding. On top of that there was a bug in splunk which affects the behavior but this is fixed in 6.3

Also remember to set the embedSecret = in server.conf .

Details are

When using report embedding, normally the generated URLs can only
  be used on the search head they were generated on
* If "embedSecret" is set, then the token in the URL will be encrypted
  with this key.  Then other search heads with the exact same setting
  can also use the same URL.
* This is needed if you want to use report embedding across multiple
  nodes on a search head pool.

I'm running a search head cluster with url loadbalancing and embedded report works fine there.

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...