After upgrading search heads from 6.3 to 6.4.2, why does scheduling dashboard PDF delivery return sendemail error "'module' object has no attribute 'which_pdf_service'"?

[vr2312]

We have upgraded the Search Heads from 6.3 to 6.4.1

Ever since we upgraded, we are unable to schedule PDF Delivery from the dashboards.

We are receiving the following error:

tail -f /Data/splunk/var/log/splunk/python.log
2016-06-06 07:05:02,114 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 07:07:40,451 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 07:08:02,028 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 07:10:02,007 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'
2016-06-06 08:00:02,089 -0400 ERROR     sendemail:1205 - 'module' object has no attribute 'which_pdf_service'

All the other report based emails are being sent out.

Any help is appreciated 🙂

[lukasz92]

Hi, I find source of my problem - which looks exactly like yours.

In my instalation, search app was not upgraded and still was on old 6.2.X version.
I repaired problem with manually copying sendemail.py from a newer splunk installation

[jkat54 · Accepted solution]

Have you made any customization to sendemail.py in the app you are in or in the search app?

C:\Program Files\Splunk\etc\apps\search\bin # on my windows box here is where i find sendemail.py.

The error message suggests there was an error on line 1205, but i only have 1201 lines in the file from a fresh install.

[atari1050]

We upgraded on 10/23 to 6.4.3 and are experiencing this issue in our default Search application. We are going to open a case with Splunk, but just wanted everyone else to know.

[jkat54]

@atari1050 Did you customize sendemail.py before the upgrade? If so it will probably have a modified date later than the date of all the other files in the same directory. Do you have a customized sendemail.py elsewhere in another app with export=system in the metadata (global setting in app manager)?

You should open another thread and relate back to this one if you want help with this via the community. It's rare folks will open an already answered question and help someone who "tacked" their issue to it.

[vr2312]

Okay, so this is what we did.

The issue was occurring with the customized apps and not with the default "search" app.

1. Bring down the splunk service
2. Copy the sendmail.py from the default "Search" app and paste it to the app you are facing this issue with. That is from /Data/splunk/etc/apps/search/bin/sendemail.py
3. Then restart the splunk service.

This worked for us.

Let us know if this fixed.

[jkat54]

I converted my comment to answer because I believe it put you in the right direction. Can you make your comment under my answer? I've tried moving it but without luck.

[vr2312]

Yes. I got the point. Thus i voted yours as the answer 😕

[jkat54]

Ok thanks! Can you MARK it as the answer? Should be a link below the answer. Thanks again!

[vr2312]

Sure.

The real answer is Splunk does not modify customized apps and scripts and it ends up updating only the default"search" app. Thus, we have to move the sendemail.py from the default search app to the other customized/cloned apps.

[jkat54]

That's exactly why I asked you "Have you made any customization to sendemail.py in the app you are in or in the search app?", splitting hairs here...

Technically, your app probably shouldn't have it's on sendemail.py. It appears you may be using the "search app" as a base for developing other apps, and that's not good if so. If your custom app didnt have this "custom" sendemail.py then the upgrade wouldnt have broken your send email functionality. I'm not saying it cant have it's own custom sendemail.py, just that it's rare you need a different sendemail.py for different apps, and if you do this intentionally, then you should be sure to review the newer splunk version of sendemail.py with every upgrade and merge the changes into your custom version of sendemail.py.

[banderson7]

I had another search head that wasn't part of the cluster, that was able to send the pdf via scheduled search. I'll copy the sendemail.py from it to the other boxes and see what happens. Thanks!

[vr2312]

Any luck ?

[vr2312]

When splunk migrates to a newer version, it updates only the search app and nothing else. Else, other apps and customized apps needs to be pushed by ourselves

[banderson7]

This is happening to me as well. Same scenario, though I'm on 6.4.1. I get the same error message as well. Have you gotten anywhere w/ this?