Reporting

Can't attach PDF - ssName and pdfViewID unavailable

atayarani_impri
Explorer

I'm trying to generate PDF reports with this search:

source="/var/log/messages" host="ejabber-1" | head 1 | sendemail sendpdf=true to=email address

I get the email, but I also get a PDF error in python.log:

An error occurred while generating a PDF of this report: Can't attach PDF - ssName and pdfViewID unavailable

PDF email does work via the scheduled PDF function.

I'm running Splunk 5.0.1 and CentOS 6.2.

Tags (2)

BernardEAI
Communicator

@atayarani_impri  This problem typically occurs when the name of the custom command does not match the name defined in the sendemail.py file. I encountered this when I made a copy of the default sendemail.py file to make our own custom sendemail command. I named the new command newsendemail (with the file newsendemail.py). 

In the file newsendemail.py, there is a piece of code:

 

sendemailRegex = r'\|\s*sendemail'
if (re.findall(sendemailRegex, searchToRun)):
  parameters['input-search'] = re.split(sendemailRegex, searchToRun)[0]
  parameters['et'] = jsonJob.get('earliestTime')
  parameters['lt'] = jsonJob.get('latestTime')
else:
  raise PDFException("Can't attach PDF - ssName and pdfViewID unavailable")

 

This is where that error is generated. For us, I had to change the 

r'\|\s*sendemail'

part to

r'\|\s*newsendemail'

The regex is searching for 'sendemail' in the search query, but the name of the custom command has been changed to 'newsendemail', so the regex needs to be updated. The error occurs if the regex does not find anything in the search query.

0 Karma

krusty
Contributor

Hi, we still have a similar problem. We upgraded from 4.3.3. to 5.0.6 directly. After this we only got this message in the python.log if we try to generate scheduled reports from our views/dashboards.

2013-11-27 07:35:01,371 ERROR local variable 'ssName' referenced before assignment while sending mail to: my.mail@address.com

Does anybody found a solution to fix it?

0 Karma

atayarani_impri
Explorer

This was answered for me in a ticket, but since I can't really explain why it works now, I'm going to leave this open for the others that need help.

0 Karma

batcave
Explorer

anyone with any answer on this?

0 Karma

feorlen
Splunk Employee
Splunk Employee

Some other people ran into a problem with this message after upgrading, perhaps you customized some email settings in alert_actions.conf in a previous version? Seems we have a migration oopsie with that. Try commenting out any custom "command = " in your local/alert_actions.conf.

0 Karma

krusty
Contributor

I tried your solution but nothing happens.

Before I read this article our local/alert_actions.conf Shows like this:

[email]
reportServerEnabled = 1
reportServerURL =
from = splunk@domain.com
mailserver = localhost

I changed it to this and restart the splunk server process.

[email]
from = splunk@domain.com
reportServerURL =

But unfortnately we have the same problem.

0 Karma

atayarani_impri
Explorer

@bfinney, I still haven't heard back on this one. The answer would definitely be appreciated.

0 Karma

bfinney
Engager

Did you ever find a solution to this problem? I am getting the same error.
Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...