Solved: Problem with scheduled dashboard

krusty · ‎11-21-2013

Hi there,

I use splunk version 4.3.3 and I have a problem with scheduled dashboards.
I want send an automatic email with an pdf attachment which shows the result of a spezific dashboard.
If I run the dashboard with the browser everything looks fine. If I try to schedule the dashboard to send an email with attached pdf I can't see anything. No error, no email, nothing.

I checked the functionality of the PDF server. If I schedule a single search I got the email with the attached pdf. So I guess that the pdf server is running fine.
I also can generate the status page of the pdf server.

Did someone has the same problem and could fix it with an upgrade to a newer version of splunk?
Or, does someone have expierence with scheduling dashboards with a newer splunk version?

Please note that I couldn't upgrade to the latest version because some apps which I need wouldn't supported in this version at the moment.

Unfortunately I couldn't find any thread here which describes my problem.

Kind regards

edit:

The search job inspector told me the following:
"This search has completed, but did not match any events. The terms specified in the highlighted portion of the search: "

None

"over the time range: "

1/1/70 1:00:01.000 AM – 1/1/70 1:00:02.000 AM

edit2:
I only use simple XML for my Dashboard

< ?xml version='1.0' encoding='utf-8'?>
< dashboard>
< label>test_pdf_dashboard
< row>
< table>
< searchName>test_pdf_dash
< title>test_pdf_dash
< /table>
< /row>
< /dashboard>

[edit3:]
I think I located the problem but I didn't know to fix it.

The following lines are from the python.log file.

2013-11-26 13:55:24,555 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'.
2013-11-26 13:55:24,555 DEBUG Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'.
2013-11-26 13:55:24,556 DEBUG simpleRequest > GET https://127.0.0.1:8089/servicesNS/nobody/search/admin/alert_actions/email [] sessionSource=direct
2013-11-26 13:55:24,568 DEBUG simpleRequest < server responded status=200 responseTime=0.0118s
2013-11-26 13:55:24,570 ERROR local variable 'ssName' referenced before assignment while sending mail to: myatemail.address

Does anyone know this Problem?

I'm upgraded the splunk server from 4.3.3 to 5.0.6 today but this didn't solve the problem.

krusty · ‎12-03-2013

Hi there,

I found the problem.
In the past we did some customizing with the sendemail.py script which is located in /opt/splunk/etc/apps/search/bin. We saved the prepared file with the filename sendemail_mod.py and generated a commands.conf file where we define the new path and filename for the command sendemail.

With the new splunk version (5.0.6) the old sendemail_mod.py script wouldn't work anymore. So we got the error messages in the python.log file.
I changed the new sendemail.py file to our requirements and everything works fine so far.

Thank you delink for helping.

View solution in original post

surekhasplunk · ‎10-18-2016

Hi,

In my xml i am using a .png file which am using to show in the dashboard.

<panel>
  <html>
    <img src="/static/app/search/Level3_description.png"/> 

</panel>

The image very well comes up in the dashboard but when i try to schedule pdf delivery and do a "Preview PDF" the image seems missing with error "expected string or buffer"

krusty · ‎12-03-2013

Hi there,

I found the problem.
In the past we did some customizing with the sendemail.py script which is located in /opt/splunk/etc/apps/search/bin. We saved the prepared file with the filename sendemail_mod.py and generated a commands.conf file where we define the new path and filename for the command sendemail.

With the new splunk version (5.0.6) the old sendemail_mod.py script wouldn't work anymore. So we got the error messages in the python.log file.
I changed the new sendemail.py file to our requirements and everything works fine so far.

Thank you delink for helping.

delink · ‎11-27-2013

If you are using only Simple XML in your Dashboards, you should no longer need the pdfserver app in Splunk 5+. There are now native PDF capabilities that work with the Simple XML dashboards. I would recommend trying to remove the pdfserver application and reschedule the search to deliver PDFs.

Also, the time range that is showing seems to be for a specific range of time very close to the epoch time of zero, or January 1, 1970. You should double-check your time range specified in the saved search and make sure it is over the time period you would like. For example, if the search is over the previous hour, you may want to do something like -65m@m to -5m@m. This time lag will ensure that all the events you are searching are safely in the index.

krusty · ‎11-27-2013

Both config files on test and production server are the same. 😞

delink · ‎11-27-2013

Under Manager->System settings->Email alert settings at the bottom are all of the settings related to the PDF Server. You may have to disable the settings related to the pdfserver app here. I believe the config file is called alert_actions.conf as well, so you could do some comparisons between the test system and production to see what is different.

krusty · ‎11-27-2013

Hi delink!

Thank you for your answer.
Today I removed the pdfserver app. But I still have the same problem.

I also installed a new test server with the same splunk version 5.0.6.
With this server I could schedule views and will receive emails with pdf attachments.

At the moment I think the problem is located with the "old", migrated configuration files. But if I checked the files and the splunk server health with btool I couldn't find the problem.

Do you have any ideas how to locate the problem?

Problem with scheduled dashboard

Adoption of RUM and APM at Splunk

Routing logs with Splunk OTel Collector for Kubernetes

Welcome to the Splunk Community!