Reporting

Error by generating PDF from Search Results

oHable
Explorer

Hi,

every day i generate 8 reports which are converted to PDF. Then 1 send them by using EMail to an internal EMail adress. One of the 8 searchresults cannot be converted to PDF, the following error is written to /opt/splunk/var/log/splunk/python.log.
Any idea how to fix that? (sending the results as CSV is not the solution i am looking for :))

Search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)\%[013456789].|\%[a-f]."| table _time, host, clientip, method, uri, status

Note: %20 to %29 not included in this search :); search works, results as expected (in splunk).

OS: Linux xxx.xxxxx.xxxxx 2.6.18-348.4.1.el5 #1 SMP Fri Mar 22 05:41:51 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
CPU: 4 x Intel(R) Xeon(R) CPU X5680 @ 3.33GHz, 8GB Memory

Logfile: /opt/splunk/var/log/splunk/python.log

2013-07-15 07:36:47,876 +0200 ERROR pdfgen_endpoint:187 - Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable

...(423.275590551 x 1260) too large on page 2 in frame 'normal'(439.275590551 x 685.88976378*) of template 'Later'
2013-07-15 07:36:47,919 ERROR An error occurred while generating a PDF of this report: Failed to fetch PDF (status = 400): Unable to render PDF.
  • Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable <Table@0x07E5BF38 564 rows x 7 cols>...(423.275590551 x 1260) too large on page 2 in frame 'normal'(439.275590551 x 685.88976378*) of template 'Later'

2013-07-15 07:36:47,955 INFO Sending email. subject="WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)", results_link="xxxxxxxxxxxx", recipients="['xxxxx@xxx.xx']"

sincerely oliver

Tags (1)

nmistry_splunk
Splunk Employee
Splunk Employee

From the error: seems like the results table is too large to fit on page. The result table has 564 rows x 7 cols and probably its size is 423x1260 pixels.

If you dont mind, can you share the data or a screen shot of what is expected?

0 Karma

oHable
Explorer

Hi,

thanks a lot for the fast response.

My solution is to define a kind of max field length by using the following rex:

rex field=uri max_match=0 "(?< uri >.{0,128})"

working search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)%[013456789].|%[a-f]."| rex field=uri max_match=0 "(?< uri >.{0,128})"| table _time, host, clientip, method, uri, status

works well, now the PDF is generated without any erros 🙂

sincerely oliver

Source: http://splunk-base.splunk.com/answers/84053/how-to-set-max-column-length

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...