Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Generate dashboard PDFs

Splunk enables you to generate PDFs of your dashboards at the click of a button. You can also arrange to have Splunk generate PDFs on a regular schedule and send them to project stakeholders on a regular schedule.

Splunk's integrated PDF generation functionality has a few limitations.

  • PDFs in languages, such as Hebrew, where text should appear in right to left order, are rendered with text in left to right order.
  • It cannot generate PDFs of dashboards that are built using advanced XML.
  • It cannot generate PDFs for forms.
  • When generating PDFs of dashboards that have been built with simple XML, it will ignore any charting customizations that are unsupported by the JSChart charting library. The finished PDF will display the panels as rendered in JSChart with the unsupported customizations removed.

For more information about integrated PDF generation see "Upgrade PDF printing for Splunk Web" in the Installation Manual.

Generate individual dashboard PDFs

When you are viewing a particular dashboard you can immediately generate a PDF of it by clicking the Generate PDF button at the top of the dashboard. The resulting PDF will appear in your browser window, displaying results that are accurate up to the moment that the button was clicked.

Arrange to deliver PDFs of a dashboard via email to a set of recipients

There are many situations that might warrant the scheduled delivery of dashboard views via email. For example, you could have an executive team that wants to receive an operations report in their inbox on a daily or weekly basis. To address this, you would first set up a dashboard view that presents high-level operations metrics in table and chart form. Then you would use this functionality to generate and distribute it on a regular schedule to the stakeholders via email, as a PDF attachment.

To set up a scheduled dashboard PDF delivery via email, first go to the dashboard view that you want to share. Click Schedule PDF delivery at the top of the dashboard to open the Schedule PDF delivery dialog.

5.0 sched dash PDF.jpg

Select a predefined email delivery schedule from the Email Schedule list, or define one of your own using standard cron notation. When you select the Cron... option from the list, a field appears in which you can enter the cron schedule.

Note: Splunk only uses 5 parameters for cron notation, not 6. The parameters (* * * * *) correspond to minute hour day month day-of-week. Splunk does not use the 6th parameter for year, common in other forms of cron notation.

Here are some cron examples:

*/5 * * * *       : Every 5 minutes
*/30 * * * *      : Every 30 minutes
0 */12 * * *      : Every 12 hours, on the hour
*/20  * * * 1-5   : Every 20 minutes, Monday through Friday
0 9 1-7 * 1       : First Monday of each month, at 9am.

Under Deliver To, identify one or more email recipients, separated by comas, and under Paper Setup choose the paper size and orientation for the PDF that Splunk will generate.

You can test your settings. Click Preview to see a preview of the PDF as your recipients will see it. Click Send Test Email to verify that the email settings work correctly.

When everything is filled out, click Schedule to schedule the PDF for delivery via email to the designated recipients, on the schedule that you've indicated. Each dashboard PDF will display results that are correct for the moment that the dashboard was generated.

Important: Use of this feature requires you to configure your email server settings in Manager. If you don't have this set up, contact a system administrator. For more information see "Upgrade PDF printing for Splunk Web" in the Installation Manual.

For more information about dashboards in Splunk apps, start with "Splunk default dashboards" in this manual. From there you can get to topics that show you how to create simple dashboards with the visual dashboard editor and design more complex ones using XML.

Note: You can also send PDF printouts of scheduled searches as email attachments. For more information on setting this up, see "Create a scheduled search" in this manual.

Stopping delivery of PDFs for a dashboard

If you want to discontinue PDF delivery via email for a specific dashboard, go to the dashboard in question and click Schedule PDF Delivery. The Schedule PDF Delivery dialog will appear with a Stop Scheduling button. Click Stop Scheduling to make Splunk stop delivering PDFs of the dashboard on the assigned schedule.

Reduce the number of rows generated for dashboard tables

The default number of rows that Splunk will generate for a simple results table in a dashboard panel is 1000. This means that if you have a dashboard with a panel that has 750 rows total, all 750 of those rows will be generated for the PDF, which will stretch it out to several pages in size.

You can override this default by opening limits.conf and reducing the value of the max_rows_per_table parameter. Keep in mind that this change will affect all of the dashboard PDFs printed by your Splunk instance.

Edit dashboard panel visualizations
Overview of simple XML

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters