Splunk® Enterprise

Installation Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Upgrade PDF printing for Splunk Web

Starting with Splunk 5.0, you can create PDFs of your dashboards, views, searches, or reports without using a Linux server.

What does this mean?

PDF functionality in Splunk Web no longer requires you to install the (now deprecated) PDF Report Server App. In addition, non-UI PDF reporting functionality uses this new integrated PDF generation.

There are exceptions involving forms, dashboards that are built with advanced XML, and simple XML dashboards that have panels that are rendered in Flash rather than JavaScript. See the "Exceptions" section, below, for more information.

Use integrated PDF generation

You can:

  • Generate PDFs of dashboards with a click of a button.
  • Arrange to have PDFs of searches, reports, and dashboards sent to a set of recipients that you define, on a regular schedule.
  • Arrange to have PDFs of searches and reports sent to a set of recipients that you define when specific alert conditions are met.

Generate dashboard PDFs

When you are viewing a dashboard in Splunk, click Generate PDF to generate a PDF that you can view through your browser or a PDF viewer application. For more information about this feature, see "Generate dashboard PDFs" in the Data Visualizations Manual.

If you use a browser that does not display graphics in the PDF format (such as IE8) you should install a PDF viewer application (if your OS does not already provide one) to enable viewing of the PDFs that Splunk generates.

Send PDFs on a regular schedule via email

You can send PDFs of reports and dashboards to interested parties on a regular schedule via email. The schedule can be any interval you require: Every hour, every day at midnight, weekly each Sunday at noon, and so on.

To send a PDF of a report to one or more recipients on a regular schedule via email, you'll use the Create Scheduled Search dialog when you create a search that returns useful results and have formatted it to appear in a pleasing manner. Just click Create and select Scheduled search... For more information, see "Create a scheduled search" in the Alerting Manual.

To send a PDF of a dashboard to one or more recipients on a regular schedule via email, navigate to the dashboard and click Schedule PDF Delivery to open the Schedule PDF Delivery dialog. For more information see "Generate dashboard PDFs" in the Data Visualizations Manual.

Splunk also enables you to set up one-time email delivery of PDF-rendered search results with the sendemail search command. When you include this command in a search, you can arrange to have the search results sent in PDF format when you run the search. For details see the sendemail topic in the Search Reference. (Note that the sendemail command does not enable you to set up scheduled emails--it just sends an email of the search results whenever you run the search.)

Send PDFs with alert emails

You can design alerts that, when triggered, send emails with PDF attachments that show the results of the triggering search. For more information about the different kinds of alerts that you can design, read "About alerts" in the Alerting Manual.

Exceptions: Advanced XML, Forms, and Flash

Integrated PDF generation cannot:

  • Generate PDFs from dashboards that are built with advanced XML.
  • Generate PDFs from forms.
  • Make use of chart customization parameters that are only available for Flash (rather than JavaScript) in PDFs.
  • Print heat maps.

Dashboards and forms that use advanced XML aren't printed

If you want to continue printing a pre-5.0 dashboard that uses advanced XML, and you have installed the old PDF Report Server App, you have the following options:

  • Change nothing. Splunk will continue to use your PDF Report Server App to generate a PDF of the dashboard.
  • Create a simple XML version of the dashboard, using charting library properties that are supported by the JSChart charting library, which renders chart graphics with JavaScript rather than Flash.

There are advanced dashboard features (such as search postprocessing) that can currently only be achieved with usage of advanced XML. Take note, however, that in Splunk 5.0, two dashboard features that were previously only available with advanced XML--dynamic drilldown and form searches--have been made available in simple XML. For more information about these features, refer to "Dynamic drilldown in dashboards and forms" and "Build and edit forms with simple XML" in the Data Visualizations Manual.

Forms won't be printed

Integrated PDF generation cannot print forms at this point, whether they have been constructed with simple or advanced XML. You can still print forms with the PDF Report Server App.

Flash-only chart customizations are ignored

As noted in the "About JSChart" topic of the Data Visualizations manual, Splunk uses the JSChart charting library to render dashboard panels for viewing through your browser except in cases where chart customizations that aren't supported by JSChart are implemented in the underlying simple XML. Panels that have JSChart-unsupported customizations are instead rendered for browser display by the Flash charting library.

Integrated PDF generation relies solely on the JSChart charting library to render images of dashboard panels in PDFs. Because of this, when Splunk uses integrated PDF generation to generate a PDF of a dashboard it renders all dashboard panels with JSChart. When dashboard panels include simple XML chart customizations that are unsupported by JSChart, Splunk ignores those customizations.

This means that panels with JSChart-unsupported customizations may appear different in PDF format than they do in your browser. In the browser they are rendered with Flash and have the customizations, while in the PDF they are rendered with JSChart and do not include the customizations.

To see which charting library parameters are supported by JSChart, go to the custom charting configuration reference in the Data Visualizations manual. Each topic in the reference contains tables of chart customization parameters, and each table has a Supported by JSChart? column.

Note: Over time we will be increasing the number of chart customization parameters that are compatible with JSChart, which means that you'll be able to make a wider range of customizations to your dashboard panels and still have them print correctly through integrated PDF generation.

Heat maps aren't printed

The heat map shading in a visualization doesn't appear in a PDF. The rest of the visualization does (assuming it's not Flash or Advanced XML).

Real-time searches and integrated PDF generation

Integrated PDF generation handles the generation of PDFs for real-time searches differently than the PDF Report Server App does.

When you use integrated PDF generation to generate a PDF for a search, report, or dashboard panel that runs in real time, Splunk converts the search to a historical search (essentially removing the "rt" from the time range). So if you have a real-time search with a 5 minute window, the PDF will display the result of this search as if it had only been run over the past 5 minutes relative to the moment the PDF was generated.

If your dashboard has panels that display results for searches with "real-time all time" time ranges, the PDF of that dashboard will display results for the same searches over all time.

Enable usage of non-latin fonts in PDFs

Splunk comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how the CID fonts are loaded by making changes to the reportCIDFontList parameter in alert_actions.conf. If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list will be used. By default, reportCIDFontList = gb cns jp kor, which reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

If multiple fonts provide a glyph for a given character code the glyph from the first font specified in the list will be used. To skip loading any CID fonts, leave the value of reportCIDFontList blank.

If you want your PDFs to make use of another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk admin add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, Splunk will sort through them in alphabetical order. This means that if you have Cyrillic and Greek installed it will always choose Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so Greek comes first.

Additional configuration for integrated PDF generation

You can configure certain aspects of integrated PDF generation in limits.conf and alert_actions.conf.

limits.conf

In the [pdf] stanza you can set the max_rows_per_table to set the maximum number of table rows that Splunk will print out for simple results tables in a PDF. The default is 1000.

Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard.

In the same stanza you can change the render_endpoint_timeout to a number other than the default 3600 seconds (1 hour). This controls the amount of time that Splunk will wait to generate a PDF of a slow-completing search.

alert_actions.conf

The reportIncludeSplunkLogo parameter for alert_actions.conf controls whether the Splunk logo appears in the PDF footers. It is set to 1 (true) by default. If you don't want to see the Splunk logo in your PDFs, set the value to 0 (false).

What to do if you have already installed the PDF Report Server App

Not much, really.

If you are printing a set of search results or a formatted report (that displays a table or visualization), Splunk will print it with integrated PDF generation. Splunk will also use integrated PDF generation to print dashboards that have been constructed in simple XML, omitting images of panels that are rendered in Flash.

You still need to configure settings in Manager > System settings > Email alert settings if you want to schedule delivery of PDFs by email or use the sendemail command.

Splunk will continue to print views (forms and dashboards) that are constructed in advanced XML with the PDF Report Server App.

What to do if you have not installed the PDF Report Server App

You don't need to install the PDF Report Server App unless you want to print forms and dashboards that either are constructed with advanced XML or which include panels rendered with Flash. See the "Exceptions" subtopic, above, for more information.

System requirements

Supported operating systems:

  • Solaris (x86 only, not SPARC)
  • Linux Kernel vers. 2.6.x and above
  • Windows Server 2003/2003 R2 (64-bit), 2008/2008 R2 (64-bit)
  • Windows Vista (64-bit), XP, 7 (64-bit)
  • Mac OS X 10.5 and 10.6 on Intel Macs

Integrated PDF Generation is supported on any browser that Splunk is also supported on. However, if you're using Internet Explorer, you will encounter fewer rendering issues if you also install Adobe Acrobat.

I still need help with the PDF Report Server App

If you have previously installed the PDF Report Server App and are experiencing problems, refer to the topic on common symptoms with the PDF Report Server App in the Troubleshooting Manual.

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about PDF generation.

PREVIOUS
Upgrade to 5.0 on Windows
  NEXT
Migrate a Splunk instance

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18


Comments

Hi Mmeyer18,<br /><br />You can't directly control page breaks. You might try reordering the panels in your dashboard. Thanks for your feedback!

Jlaw splunk, Splunker
April 29, 2013

How do I modify the pdf to change the page breaks so there isn't wasted space or pages?

Mmeyer18
April 29, 2013

Cristophe: Thanks for your feedback. We do intend to continue improving on our PDF generation feature in future releases. <br /><br />At this time, the only way to force Splunk 5.0 to use PDF Report Server is to convert the view in question to Advanced XML.

Dlamas splunk, Splunker
February 25, 2013

Dieusplunk: Thanks for your question. Note that Integrated PDF Generation is not officially supported for AIX.<br />Follow this DEVELOPING ISSUE on Answers!<br /><br />http://splunk-base.splunk.com/answers/69591/generate-pdf-from-a-dashbord-throws-errno-2-no-such-file-or-directory-exception-error-for-graph-panels?page=1&focusedAnswerId=74188#74188

Jlaw splunk, Splunker
February 1, 2013

PDF don't work with my configuration !<br />When i "generate PDF" i have this message :<br /><br />Unable to render PDF.<br /><br /> Exception raised while trying to prepare "accouting_type_day" for rendering to PDF. [Errno 2] No such file or directory<br /><br />Do you have any idea ?<br /><br />OS : AIX 7.1<br />SPLUNK : 5.0.1

Dieusplunk
February 1, 2013

I'm signing to this question. I want to set App Server as default.

Bckq
December 11, 2012

The output of the new PDF engine is not as pretty as the one generated by the PDF Report Server App. That's fine to replace an existing feature with a built-in one (especially for Windows guys in this case) but only if the new one is equal or better than the old one (i.e. do not follow Apple Maps examples).<br /><br />How can we re-enable the PDF Report app for standard reports? I send reports to my business departments, that's a serious question.<br /><br />Thanks

Christophe sahut
December 4, 2012

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters