Splunk Search

Dashboard PDF email failing

elumpkin_caisgr
Engager

A dashboard will export to PDF correctly, but anytime we try to send it via email (be it a test email or scheduled) no email is sent and we see the following internal log entry. This was working for many months (years?) and suddenly stopped working. And is true for any/all dashboards we have created.

2019-04-25 12:00:00,368 -0400 WARNING   sendemail:1398 - search results is empty, no email will be sent
host =       source = /apps/splunk/var/log/splunk/python.log      sourcetype = splunk_python

Splunk Enterprise
Version:
7.2.6
Build:
c0bf0f679ce9

0 Karma
1 Solution

gailuh
Engager

The same problem occured for me. Workaround for this problem was to exchange the sendemail.py version. I used the sendemail.py version from Splunk 7.2.0 with full path: /etc/apps/search/bin/sendemail.py. Dashboard email sending working as usual afterwards.,

View solution in original post

dfgrtKJH
Path Finder

I can confirm this was fixed in 7.3.0.
Yes the changelog does not contains this bugfix, which is rather unprofessional in my optinion.
This thread can be closed.

0 Karma

aaron_sakovich
Path Finder

We were having this problem with 7.2.6, and the issue was resolved with the 7.3 update -- though I could not find any reference to it in the release notes.

The contents of the sendemail.py program look markedly different, so obviously a lot of code therein was touched by this update.

Just glad it's working again,
Aaron

dfgrtKJH
Path Finder

solution if you do not have the old version:

  1. create backup of /opt/splunk/etc/apps/search/bin/sendemail.py
  2. open /opt/splunk/etc/apps/search/bin/sendemail.py (Splunk 7.2.6) with a editor as a user with write permissions.
  3. remove line 1398 "logger.warn("search results is empty, no email will be sent")"
  4. remove line 1397 "else:"
  5. remove 4 spaces at the start of lines 1393-1396 (if, results=,else,results=)
  6. remove line 1392 "if results:"
  7. save file
  8. test
0 Karma

dfgrtKJH
Path Finder

Splunk Support:

I understand that your PDF scheduled from dashboards are no longer working on 7.2.6. I confirmed this is a known issue and we are actively working on finding a solution for it.

We have found two possible workarounds:
- Replace sendemail.py from 7.2.6 with the same file in your older version.
- Edit your saved search, in the "Search" field replace "| noop" with "| makeresults".

For the moment, the issue is still unresolved.

0 Karma

dfgrtKJH
Path Finder

I have the same error.
Splunk 7.2.6
When sending Dashboard as pdf via mail (scheduled or with "send test email" command):
2019-04-25 12:00:00,368 -0400 WARNING sendemail:1398 - search results is empty, no email will be sent

When i open the Dashboard in Splunk i see that it is not empty...

0 Karma

JAvnaim
Explorer

Hello,

I have the same issue, which appears to be introduced in 7.2.6, as email PDF delivery was working prior to upgrade.

I'd like to try the workaround, however am slightly confused as where to find the sendemail.py version from Splunk 7.2.0 ? Do I need install 7.2.0 and extract sendemail.py or is there an archive somewhere I could pull it from?

Thanks for your help!

Jordan

0 Karma

gailuh
Engager

The same problem occured for me. Workaround for this problem was to exchange the sendemail.py version. I used the sendemail.py version from Splunk 7.2.0 with full path: /etc/apps/search/bin/sendemail.py. Dashboard email sending working as usual afterwards.,

saramamurthy_sp
Splunk Employee
Splunk Employee

Does this workaround apply for 7.2.9 as well?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...