Dashboards & Visualizations

Why are some of my charts not displayed properly after exporting my dashboard to a PDF file?

hnoboru_splunk
Splunk Employee
Splunk Employee

I have a dashboard which has 10 charts, and I set it up to refresh every 10 seconds.

<refresh>10s</refresh>


When I exported the dashboard to a PDF file, some of my charts were not displayed properly. (The other charts were showing properly.)

Instead, URLs like below are shown, and when I tried to access the URL, Unknow sid error is shown up on the browser.

https://IP:8089/services/search/jobs/admin__admin__search__search8_1548139350.27149/results?count=10...>

{"messages":[{"type":"FATAL","text":"Unknown sid."}]}

hnoboru_splunk
Splunk Employee
Splunk Employee

[Answer]

This issue is happening due to the timing of dashboard refresh and pdf export.

When a dashboard is due to refresh, it calls cancel of all the dashboard search jobs and request for a fresh run.
This issue happens when refresh kicks while pdfgen is still rendering the searches.
This is a limitation to PDF generation. (We'll update the document soon.)

https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/DashboardPDFs

[Workaround]

  • Change the refresh time to a bigger value (the issue still happens, but the frequency becomes lesser.)
  • Disable the refresh time and change the search to real-time search *Please note real-time search consumes more resources.

    https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Aboutrealtimesearches

[Behavior]

  • dashboard

      0. Dashboard is updated.

      1. Wait for the refresh time.

      2. The refresh time has passed.

      3. Change the status of searches to cancel. (To prevent Splunk having 2 valid search results.)

      4. Request a new search, and return to 0.

  • pdfgen

      a. Find all Search IDs for all searches.

      b. Render the search results using data in the corresponding folders under dispatch.

      c. PDF is created.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...