Splunk Search

Splunk PDF export issue with "empty" pdf

flo_cognosec
Communicator

Actually the view below shows "No results found." in the browser by opening the view and as soon as I try to generate a pdf I get an empty graph with just the two axis shown.
(Printing the View and THEN exporting it to pdf works, so the web "output" is def. fine)
I would like to get rid of the graph with the axis and get a result in the pdf as in the web-gui: No results found.

How to either exclude an empty report from the pdf generation or output the fact that no data matches the query ?

Splunk Vers. 5.0.1
PDF Server for Linux 1.2
Sideview Utils 1.3.5
Search 5.0.1

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Report</label>
  <row>
    <chart>
      <searchString>index="summary" event="failed_log" | timechart fixedrange=True sum(count) by user</searchString>
      <title>Failed Login</title>
      <earliestTime>-1m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisLabelsY.majorUnit">1</option>
      <option name="charting.axisTitleX.text">time</option>
      <option name="charting.axisTitleY.text">count</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.layout.splitSeries">false</option>
      <option name="charting.legend.placement">right</option>
    </chart>
  </row>
</dashboard>
0 Karma
1 Solution

jayannah
Builder

This the limitation in the Splunk. Not supported in the latest version aswell.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/DashboardPDFs

View solution in original post

jayannah
Builder

This the limitation in the Splunk. Not supported in the latest version aswell.

http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/DashboardPDFs

flo_cognosec
Communicator

Update

This seems to be a bug in splunk. At least that's what I got in an support email.
So if this happens to you, update to a later version of splunk

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...