Hi,
every day i generate 8 reports which are converted to PDF. Then 1 send them by using EMail to an internal EMail adress. One of the 8 searchresults cannot be converted to PDF, the following error is written to /opt/splunk/var/log/splunk/python.log.
Any idea how to fix that? (sending the results as CSV is not the solution i am looking for :))
Search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)\%[013456789].|\%[a-f]."| table _time, host, clientip, method, uri, status
Note: %20 to %29 not included in this search :); search works, results as expected (in splunk).
OS: Linux xxx.xxxxx.xxxxx 2.6.18-348.4.1.el5 #1 SMP Fri Mar 22 05:41:51 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
CPU: 4 x Intel(R) Xeon(R) CPU X5680 @ 3.33GHz, 8GB Memory
Logfile: /opt/splunk/var/log/splunk/python.log
2013-07-15 07:36:47,876 +0200 ERROR pdfgen_endpoint:187 - Exception raised while trying to render "WSL: Suche nach encodierten Zeichen ohne Leerzeichen (%20)" to PDF. Flowable
From the error: seems like the results table is too large to fit on page. The result table has 564 rows x 7 cols and probably its size is 423x1260 pixels.
If you dont mind, can you share the data or a screen shot of what is expected?
Hi,
thanks a lot for the fast response.
My solution is to define a kind of max field length by using the following rex:
rex field=uri max_match=0 "(?< uri >.{0,128})"
working search:
index=xxx sourcetype="xxx" earliest=-7d uri!="$FILE" host!="xxx"| regex uri="(?i)%[013456789].|%[a-f]."| rex field=uri max_match=0 "(?< uri >.{0,128})"| table _time, host, clientip, method, uri, status
works well, now the PDF is generated without any erros 🙂
sincerely oliver