Configure PDF printing for Splunk Web

Configure PDF printing for Splunk Web

Splunk Web users can generate PDF output from any dashboard, view, search or report. To enable this functionality, you must download the PDF Report Server App from Splunkbase. Next install this into a Splunk instance on a single Linux host. The PDF Report Server App for that Splunk instance will then accept requests from all other Splunk hosts on the network.

Note: Splunk PDF printing is not yet available on the Windows platform. Currently you must have a Linux instance of Splunk running on your network to support PDF printing.

PDF printing requires a Splunk Enterprise license. For more information about Splunk licenses, refer to Types of Splunk licenses in the Admin Manual.

Note: To configure a machine to act as a PDF server, you can use the Forwarder license as described in Types of Splunk licenses - Forwarder license in the Admin Manual as long as that Splunk instance does no indexing.

System requirements

Only the instance of Splunk hosting the PDF Server functionality has to be running Linux; it will then serve PDFs to any Splunk instance on the network, regardless of the platform.

The PDF Server is supported on any Linux server that:

• is running Splunk 4.1 or later
• has the Xvfb X server, xauth, and base fonts installed
• has glibc 2.3 or later installed (glibc 2.4 required for 64 bit systems such as Centos 5.0 or later, needed by Flash)

Note: SuSE Linux Enterprise 10 users. You are likely to encounter a known bug with libfontconfig version 2.3.93 on this platform, where it crashes when being used by PDF Server. Please update libfontconfig to a release version, or request assiistance from SuSE to resolve the issue.

How to configure PDF printing

Download and install the PDF Report Server app

1. Install Splunk 4.1 or later on a Linux host. For instructions, refer to "Install on Linux" in this manual.

2. Download and install the PDF Report Server app. You can click Browse more apps in Launcher, or you can download it separately from Splunkbase here. (Manual app installation instructions can be found here.)

3. Ensure that the Xvfb X server, xauth and fonts for your Linux distribution are installed. These are included with most Linux distributions, but not installed by default.

• On Redhat/CentOS/Fedora, type: yum install Xvfb xauth bitstream-vera-fonts (note the capital X for Xvfb).
• On Debian/Ubuntu, type: apt-get install xvfb xauth fontconfig libxrender1 libxinerama1
• Note that the names of font packages tend to change more than other package names.

4. Launch Splunk Web on the Linux host and navigate to Manager.

5. Navigate to System Settings > Email Alert Settings.

6. Check the Use PDF Report Server box.

7. Click Save.

This host is now configured to serve PDFs to all Splunk hosts with PDF printing enabled as described in the next section.

Note: If the hostname of the Splunk Web instance that this PDF Report Server will talk to is not resolvable in DNS, enter its IP address or a hostname that resolves to that IP in the Link hostname field. This will ensure that Splunk Web can contact the PDF Report Server, and that links sent in emailed PDF reports work correctly. If the field is left empty, Splunk will try to autodetect the hostname.

Enable PDF printing on a search head

On each search head you want to have access to the PDF printing feature:

1. Launch Splunk Web and navigate to Manager > System settings > Email alert settings.

2. Ensure that a valid SMTP server hostname is entered in the Mail host field.

3. Check the Use PDF Report Server box. Some more options are displayed.

4. Enter the Report Server URL if the PDF Server is not installed on your search head.

This host can now use the PDF server you configured in the previous section to generate PDF reports.

You can also set the same option by enabling the reportServerEnabled option in $SPLUNK_HOME/etc/system/local/alert_actions.conf for each search head.

Use PDF printing

For information on scheduling PDF reports to be sent by email, refer to "Schedule delivery of dashboard printouts via email" in the User Manual.

Status page

Check that you can display a test PDF with the status page.

In Manager > System settings > Email alert settings, click on the small blue link for "status page".

Clicking on "status page" takes you to a new screen:

Check that the top three settings read "True." Within about a minute, a PDF should be sent to your browser. Be sure to read the message written on the PDF.

In case of trouble

If you run into problems while configuring the PDF server, such as errors in the UI, you may want to refer to $SPLUNK_HOME/var/log/splunk/python.log which may help clarify the problem.

Note: The stanza created in savedsearches.conf for the scheduled PDF will show "search = | noop". This is normal.

For more debugging, edit $SPLUNK_HOME/etc/log.cfg by setting DEBUG on

[python]

splunk = DEBUG

If the host running Splunk Web does not have a valid DNS entry for its hostname, make sure you have set the Link Hostname field in Manager > System settings > Email alert settings to a hostname that resolves to the IP address of the host running Splunk Web, or that you have specified its IP address directly.

For more specifics, see "I'm having problems with the Splunk PDF Server app" in the Troubleshooting Manual.

• Was this topic useful?
• Post a comment