Splunk® Enterprise

Reporting Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Generate PDFs of your reports and dashboards

Splunk Enterprise enables you to create PDFs of your reports, dashboards, views, searches, and pivots without using a Linux server.

What does this mean?

PDF functionality in Splunk Web no longer requires you to install the (now deprecated) PDF Report Server App. In addition, non-UI PDF reporting functionality uses this new integrated PDF generation.

There are exceptions involving forms, dashboards that are built with advanced XML, and simple XML dashboards that have panels that are rendered in Flash rather than JavaScript. See the "Exceptions" section, below, for more information.

Use integrated PDF generation

You can:

  • Generate PDFs of dashboards with a click of a button.
  • Arrange to have PDFs of searches, reports, and dashboards sent to a set of recipients that you define, on a regular schedule.
  • Arrange to have PDFs of searches and reports sent to a set of recipients that you define when specific alert conditions are met.

Generate dashboard PDFs

When you are viewing a dashboard in Splunk Enterprise, click Generate PDF to generate a PDF that you can view through your browser or a PDF viewer application. For more information about this feature, see "Generate dashboard PDFs" in the Data Visualizations Manual.

If you use a browser that does not display graphics in the PDF format (such as IE8) you should install a PDF viewer application (if your OS does not already provide one) to enable viewing of the PDFs that Splunk Enterprise generates.

Send PDFs on a regular schedule via email

You can send PDFs of reports and dashboards to interested parties on a regular schedule via email. The schedule can be any interval you require: Every hour, every day at midnight, weekly each Sunday at noon, and so on.

To send a PDF of a report to one or more recipients on a regular schedule via email, you'll use the Create Scheduled Search dialog when you create a search that returns useful results and have formatted it to appear in a pleasing manner. Just click Create and select Scheduled search... For more information, see "Schedule reports" in this manual.

To send a PDF of a dashboard to one or more recipients on a regular schedule via email, navigate to the dashboard and click Schedule PDF Delivery to open the Schedule PDF Delivery dialog. For more information see "Generate dashboard PDFs" in the Data Visualizations Manual.

Splunk also enables you to set up one-time email delivery of PDF-rendered search results with the sendemail search command. When you include this command in a search, you can arrange to have the search results sent in PDF format when you run the search. For details see the sendemail topic in the Search Reference. (Note that the sendemail command does not enable you to set up scheduled emails--it just sends an email of the search results whenever you run the search.)

Send PDFs with alert emails

You can design alerts that, when triggered, send emails with PDF attachments that show the results of the triggering search. For more information about the different kinds of alerts that you can design, read "About alerts" in the Alerting Manual.


Integrated PDF generation cannot:

  • Generate PDFs from dashboards that are built with advanced XML.
  • Generate scheduled PDFs from forms.
  • Print heat maps.

Dashboards and forms that use advanced XML aren't printed

If you want to continue printing a pre-5.0 dashboard that uses advanced XML, and you have installed the old PDF Report Server App, you have the following options:

  • Change nothing. Splunk Enterprise will continue to use your PDF Report Server App to generate a PDF of the dashboard.
  • Create a simple XML version of the dashboard, using charting library properties that are supported by the JSChart charting library, which renders chart graphics with JavaScript rather than Flash.

There are advanced dashboard features (such as search postprocessing) that can currently only be achieved with usage of advanced XML. But simple XML enables the implementation of a wide range of dashboard features, including form searches and dynamic drilldown. For more information about these features, refer to "Dynamic drilldown in dashboards and forms" and "Build and edit forms with simple XML" in the Data Visualizations Manual.

Scheduled forms won't be printed

Integrated PDF generation cannot print scheduled forms at this point, whether they have been constructed with simple or advanced XML. You can print forms with the PDF Report Server App, and you can print one-off forms that have been constructed with simple XML.

Heat maps aren't printed

The heat map shading in a visualization doesn't appear in a PDF. The rest of the visualization does (assuming it's not Flash or Advanced XML).

Real-time searches and integrated PDF generation

Integrated PDF generation handles the generation of PDFs for real-time searches differently than the PDF Report Server App does.

When you use integrated PDF generation to generate a PDF for a search, report, or dashboard panel that runs in real time, Splunk Enterprise converts the search to a historical search (essentially removing the "rt" from the time range). So if you have a real-time search with a 5 minute window, the PDF will display the result of this search as if it had only been run over the past 5 minutes relative to the moment the PDF was generated.

If your dashboard has panels that display results for searches with "real-time all time" time ranges, the PDF of that dashboard will display results for the same searches over all time.

Enable usage of non-latin fonts in PDFs

Splunk Enterprise comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how the CID fonts are loaded by making changes to the reportCIDFontList parameter in alert_actions.conf. If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list will be used. By default, reportCIDFontList = gb cns jp kor, which reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

If multiple fonts provide a glyph for a given character code the glyph from the first font specified in the list will be used. To skip loading any CID fonts, leave the value of reportCIDFontList blank.

If you want your PDFs to make use of another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk Enterprise admin add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, Splunk Enterprise will sort through them in alphabetical order. This means that if you have Cyrillic and Greek installed it will always choose Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so Greek comes first.

Additional configuration for integrated PDF generation

You can configure certain aspects of integrated PDF generation in limits.conf and alert_actions.conf.


In the [pdf] stanza you can set the max_rows_per_table to set the maximum number of table rows that Splunk Enterprise will print out for simple results tables in a PDF. The default is 1000.

Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard.

In the same stanza you can change the render_endpoint_timeout to a number other than the default 3600 seconds (1 hour). This controls the amount of time that Splunk Enterprise will wait to generate a PDF of a slow-completing search.


The reportIncludeSplunkLogo parameter for alert_actions.conf controls whether the Splunk Enterprise logo appears in the PDF footers. It is set to 1 (true) by default. If you don't want to see the Splunk Enterprise logo in your PDFs, set the value to 0 (false).

What to do if you have already installed the PDF Report Server App

Not much, really.

If you are printing a set of search results or a formatted report (that displays a table or visualization), Splunk Enterprise will print it with integrated PDF generation. Splunk Enterprise will also use integrated PDF generation to print dashboards that have been constructed in simple XML, omitting images of panels that are rendered in Flash.

You still need to configure settings in Manager > System settings > Email alert settings if you want to schedule delivery of PDFs by email or use the sendemail command.

Splunk Enterprise will continue to print views (forms and dashboards) that are constructed in advanced XML with the PDF Report Server App.

What to do if you have not installed the PDF Report Server App

You don't need to install the PDF Report Server App unless you want to print forms and dashboards that either are constructed with advanced XML or which include panels rendered with Flash. See the "Exceptions" subtopic, above, for more information.

System requirements

Supported operating systems:

  • Solaris (x86 only, not SPARC)
  • Linux Kernel vers. 2.6.x and above
  • Windows Server 2003/2003 R2 (64-bit), 2008/2008 R2 (64-bit)
  • Windows Vista (64-bit), XP, 7 (64-bit)
  • Mac OS X 10.5 and 10.6 on Intel Macs

Integrated PDF Generation is supported on any browser that Splunk Enterprise is also supported on. However, if you're using Internet Explorer, you will encounter fewer rendering issues if you also install Adobe Acrobat.

I still need help with the PDF Report Server App

If you have previously installed the PDF Report Server App and are experiencing problems, refer to the topic on common symptoms with the PDF Report Server App in the Troubleshooting Manual.


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about PDF generation.

Configure the priority of scheduled reports

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13


How do I send a fixed view's pdf with some set of alert emails?

February 13, 2014

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters