Upgrade PDF printing for Splunk Web
Starting with Splunk 5.0, you can create PDFs of your dashboards, views, searches, or reports without using a Linux server.
What does this mean?
PDF functionality in Splunk Web no longer requires you to install the (now deprecated) PDF Report Server App. In addition, non-UI PDF reporting functionality uses this new integrated PDF generation.
Use integrated PDF generation
- Generate PDFs of dashboards with a click of a button.
- Arrange to have PDFs of searches, reports, and dashboards sent to a set of recipients that you define, on a regular schedule.
- Arrange to have PDFs of searches and reports sent to a set of recipients that you define when specific alert conditions are met.
Generate dashboard PDFs
When you are viewing a dashboard in Splunk, click Generate PDF to generate a PDF that you can view through your browser or a PDF viewer application. For more information about this feature, see "Generate dashboard PDFs" in the Data Visualizations Manual.
If you use a browser that does not display graphics in the PDF format (such as IE8) you should install a PDF viewer application (if your OS does not already provide one) to enable viewing of the PDFs that Splunk generates.
Send PDFs on a regular schedule via email
You can send PDFs of reports and dashboards to interested parties on a regular schedule via email. The schedule can be any interval you require: Every hour, every day at midnight, weekly each Sunday at noon, and so on.
To send a PDF of a report to one or more recipients on a regular schedule via email, you'll use the Create Scheduled Search dialog when you create a search that returns useful results and have formatted it to appear in a pleasing manner. Just click Create and select Scheduled search... For more information, see "Create a scheduled search" in the Alerting Manual.
To send a PDF of a dashboard to one or more recipients on a regular schedule via email, navigate to the dashboard and click Schedule PDF Delivery to open the Schedule PDF Delivery dialog. For more information see "Generate dashboard PDFs" in the Data Visualizations Manual.
Splunk also enables you to set up one-time email delivery of PDF-rendered search results with the
sendemail search command. When you include this command in a search, you can arrange to have the search results sent in PDF format when you run the search. For details see the
sendemail topic in the Search Reference. (Note that the
sendemail command does not enable you to set up scheduled emails--it just sends an email of the search results whenever you run the search.)
Send PDFs with alert emails
You can design alerts that, when triggered, send emails with PDF attachments that show the results of the triggering search. For more information about the different kinds of alerts that you can design, read "About alerts" in the Alerting Manual.
Exceptions: Advanced XML, Forms, and Flash
Integrated PDF generation cannot:
- Generate PDFs from dashboards that are built with advanced XML.
- Generate PDFs from forms.
- Print heat maps.
Dashboards and forms that use advanced XML aren't printed
If you want to continue printing a pre-5.0 dashboard that uses advanced XML, and you have installed the old PDF Report Server App, you have the following options:
- Change nothing. Splunk will continue to use your PDF Report Server App to generate a PDF of the dashboard.
- Create a simple XML version of the dashboard, using charting library properties that are supported by the
There are advanced dashboard features (such as search postprocessing) that can currently only be achieved with usage of advanced XML. Take note, however, that in Splunk 5.0, two dashboard features that were previously only available with advanced XML--dynamic drilldown and form searches--have been made available in simple XML. For more information about these features, refer to "Dynamic drilldown in dashboards and forms" and "Build and edit forms with simple XML" in the Data Visualizations Manual.
Forms won't be printed
Integrated PDF generation cannot print forms at this point, whether they have been constructed with simple or advanced XML. You can still print forms with the PDF Report Server App.
Flash-only chart customizations are ignored
As noted in the "About JSChart" topic of the Data Visualizations manual, Splunk uses the
JSChart charting library to render dashboard panels for viewing through your browser except in cases where chart customizations that aren't supported by
JSChart are implemented in the underlying simple XML. Panels that have
JSChart-unsupported customizations are instead rendered for browser display by the
Flash charting library.
Integrated PDF generation relies solely on the
JSChart charting library to render images of dashboard panels in PDFs. Because of this, when Splunk uses integrated PDF generation to generate a PDF of a dashboard it renders all dashboard panels with
JSChart. When dashboard panels include simple XML chart customizations that are unsupported by
JSChart, Splunk ignores those customizations.
This means that panels with
JSChart-unsupported customizations may appear different in PDF format than they do in your browser. In the browser they are rendered with
Flash and have the customizations, while in the PDF they are rendered with
JSChart and do not include the customizations.
To see which charting library parameters are supported by
JSChart, go to the custom charting configuration reference in the Data Visualizations manual. Each topic in the reference contains tables of chart customization parameters, and each table has a Supported by
Note: Over time we will be increasing the number of chart customization parameters that are compatible with
JSChart, which means that you'll be able to make a wider range of customizations to your dashboard panels and still have them print correctly through integrated PDF generation.
Heat maps aren't printed
The heat map shading in a visualization doesn't appear in a PDF. The rest of the visualization does (assuming it's not Flash or Advanced XML).
Real-time searches and integrated PDF generation
Integrated PDF generation handles the generation of PDFs for real-time searches differently than the PDF Report Server App does.
When you use integrated PDF generation to generate a PDF for a search, report, or dashboard panel that runs in real time, Splunk converts the search to a historical search (essentially removing the "rt" from the time range). So if you have a real-time search with a 5 minute window, the PDF will display the result of this search as if it had only been run over the past 5 minutes relative to the moment the PDF was generated.
If your dashboard has panels that display results for searches with "real-time all time" time ranges, the PDF of that dashboard will display results for the same searches over all time.
Enable usage of non-latin fonts in PDFs
Splunk comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.
You can control how the CID fonts are loaded by making changes to the
reportCIDFontList parameter in
alert_actions.conf. If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list will be used. By default,
reportCIDFontList = gb cns jp kor, which reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.
If multiple fonts provide a glyph for a given character code the glyph from the first font specified in the list will be used. To skip loading any CID fonts, leave the value of
If you want your PDFs to make use of another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk admin add the Unicode font to
$SPLUNK_HOME/share/splunk/fonts. Create the
fonts directory if it doesn't already exist.
Note: When multiple fonts are installed, Splunk will sort through them in alphabetical order. This means that if you have Cyrillic and Greek installed it will always choose Cyrillic unless you change the name of the files in
$SPLUNK_HOME/share/splunk/fonts so Greek comes first.
Additional configuration for integrated PDF generation
You can configure certain aspects of integrated PDF generation in
[pdf] stanza you can set the
max_rows_per_table to set the maximum number of table rows that Splunk will print out for simple results tables in a PDF. The default is 1000.
Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard.
In the same stanza you can change the
render_endpoint_timeout to a number other than the default 3600 seconds (1 hour). This controls the amount of time that Splunk will wait to generate a PDF of a slow-completing search.
reportIncludeSplunkLogo parameter for
alert_actions.conf controls whether the Splunk logo appears in the PDF footers. It is set to
1 (true) by default. If you don't want to see the Splunk logo in your PDFs, set the value to
What to do if you have already installed the PDF Report Server App
Not much, really.
If you are printing a set of search results or a formatted report (that displays a table or visualization), Splunk will print it with integrated PDF generation. Splunk will also use integrated PDF generation to print dashboards that have been constructed in simple XML, omitting images of panels that are rendered in Flash.
You still need to configure settings in Manager > System settings > Email alert settings if you want to schedule delivery of PDFs by email or use the sendemail command.
Splunk will continue to print views (forms and dashboards) that are constructed in advanced XML with the PDF Report Server App.
What to do if you have not installed the PDF Report Server App
You don't need to install the PDF Report Server App unless you want to print forms and dashboards that either are constructed with advanced XML or which include panels rendered with Flash. See the "Exceptions" subtopic, above, for more information.
Supported operating systems:
- Solaris (x86 only, not SPARC)
- Linux Kernel vers. 2.6.x and above
- Windows Server 2003/2003 R2 (64-bit), 2008/2008 R2 (64-bit)
- Windows Vista (64-bit), XP, 7 (64-bit)
- Mac OS X 10.5 and 10.6 on Intel Macs
Integrated PDF Generation is supported on any browser that Splunk is also supported on. However, if you're using Internet Explorer, you will encounter fewer rendering issues if you also install Adobe Acrobat.
I still need help with the PDF Report Server App
If you have previously installed the PDF Report Server App and are experiencing problems, refer to the topic on common symptoms with the PDF Report Server App in the Troubleshooting Manual.
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about PDF generation.
Upgrade to 5.0 on Windows
Migrate a Splunk instance
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18