Why is dashboard "Schedule PDF Delivery" receiving wrong empty result (search custom fields)?

[ybartel]

We are on Splunk Enterprise 8.0.2 (just updated from v6 - problem occured there too).

Dashboard and manually "Export PDF" prints correct results, but "Schedule PDF Delivery" prints wrong empty data.
But converting the exact same search phrase into a report and in the dashboard, instead, references to the report and prints correct data scheduled!

this fails scheduled:

<search><query>index=$idx$ ExecEdScAbverkaeufe::true | stats count</query><earliest>@d-3d</earliest><latest>@d-2d</latest></search>

(ExecEdScAbverkaeufe is a custom field)

but this is working scheduled:

<search ref="depot_status_DESADVEd"></search>

[cmerriman]

I haven't done this in a while, so it might not be true for v8*, however I recall in v6* there was an issue with schedule PDFs that took too long to run. The PDF would render empty panels if the search ran for an extended period of time. How long does your search typically take to run?
Found the doc on this:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DashboardPDFs#Configure_the_timeout_setting_f...

default is 1h in limits.conf, not sure if your env. has the default limit or another limit set. Something you could look into to see if that's the reason?

[ybartel]

thank you for your answer! Our search just takes a couple of seconds though.
render_endpoint_timeout isnt specified in our limits.conf, so the default should be allright, right?