Why am I getting a scheduled search "datetime strftime() error", and some panels fail to render in the scheduled PDF email?

[ejharts2015]

I have a dashboard which loads a bunch of scheduled reports. This dashboard is emailed to me via pdf at 6 pm everyday. The dashboard loads/works fine, however, the pdf doesn't show all the panels.

The first panel displays correctly:
Here is the search:

index=_internal source=*license_usage.log* type=Usage earliest=@d-6h latest=@d+18h | fields b,idx,_time   | timechart span=1h sum(b) by idx  | foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]

The Second panel doesn't display at all, with no error. It's just blank.
Here is the search:

index=_internal source=*license_usage.log* type=Usage earliest=@d-6h latest=@d+18h | fields b,idx,_time   | timechart span=1h sum(b) by idx  | addcoltotals | fillnull value=TOTAL | search _time=TOTAL |  foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]

The final panel has the following error: "year=1 is before 1900; the datetime strftime() methods require year >= 1900"
Here is the search:

index=_internal source=*license_usage.log* type=Usage earliest=@d-6h latest=@d+18h | fields b,idx,_time   | timechart span=1h sum(b) by idx  | addcoltotals | fillnull value=TOTAL | foreach * [eval <<FIELD>>='<<FIELD>>'/1024/1024/1024]

What is making the last two panels fail to render via the scheduled pdf?

[ggiessen · Accepted solution]

It looks like convert is having issues...

add this to your query and pdf export works fine:

| rename _time as Date | convert ctime(Date) timeformat="%Y-%m-%d"

[ejharts2015]

It's very weird that that worked... but thanks! It was driving me crazy 🙂

[kira01]

@ejharts2015
how did you schedule email of dashboard pdf?
I want to schedule pdf delivery of dashboard using one of the conf files. But unable to do so. Can you help?

[ejharts2015]

What issue are you having with it?

[darrend]

I had the same issue on a customers site this morning.

This was just after an upgrade from 6.2.x to 6.3.x, it appears that if the _time field is present on some results then it cannot be null value(or possibly non-date value) on other results. This empty/null value was caused by the addtotals command for us.

This only appears to affect the pdf generation, the screen rendered fine.

[kfir_fireglass]

Experiencing the same issue. Also for me it affects only my pdf generation.

Couldn't find any workaround. I eventually removed the time field from the report.

[RobertaRimondo]

Same problem here, the addtotals command caused the error message above when exporting to PDF. Workaround: simply renaming the _time field with a different name (I used "Month") in the final table. It works!