Reporting

50 page PDF report not fully rendering (4.3.4)

the_wolverine
Champion

I have a large report that generates about 50 pages in PDF. The report is generated from a dashboard that contains 6 panels, all scheduled searches.

For the most part it works, but since the report has grown larger, the PDF Server fails to render the last 2 panels (at the end or the report). It just provides an empty box with the title and time of run. Manually going in and viewing the dashboard works fine.

I'd love to hear that there is some obscure parameter I can set that will allow me to workaround this.

alt text

0 Karma

nmistry_splunk
Splunk Employee
Splunk Employee

You could be hitting pdfreport server app page timeout, defaults to 180 seconds.

Splunk will wait for dashboard's print ready event or timeout event to occur, which ever happens first, to actually generate PDF. In your case it could be that it takes more than 180s to generate your 50 pager thereby resulting in empty modules in pdfs.

Try to update this firefox_timeout config in $SPLUNK_HOME/etc/apps/pdfserver/local/pdf_server.conf file to a larger number, equivalent to time in seconds it will take to load the complete page.

the_wolverine
Champion

Thanks for your answer but:
1) The report is scheduled to run at 8am and arrives at 8am. So it is unlikely hitting the 180 seconds (3 minutes) timeout.
2) I've tried raising the value previously with no change in behavior.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...