Splunk® Enterprise

Reporting Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Generate PDFs of your reports and dashboards

Beginning with version 6.2, Splunk Enterprise no longer supports the PDF Report Server App. This means that with version 6.2, you cannot generate PDFs from dashboards and forms that are based on advanced XML.

Splunk Enterprise instead uses integrated PDF generation to generate PDFs.

Use integrated PDF generation

You can:

  • Generate PDFs of dashboards with a click of a button.
  • Arrange to have PDFs of searches, reports, and dashboards sent to a set of recipients that you define, on a regular schedule.
  • Arrange to have PDFs of searches and reports sent to a set of recipients that you define when specific alert conditions are met.

Generate dashboard PDFs

When you are viewing a dashboard in Splunk Enterprise, click Generate PDF to generate a PDF that you can view through your browser or a PDF viewer application. For more information about this feature, see "Generate dashboard PDFs" in the Data Visualizations Manual.

If you use a browser that does not display graphics in the PDF format (such as IE8) you should install a PDF viewer application (if your OS does not already provide one) to enable viewing of the PDFs that Splunk Enterprise generates.

Send PDFs on a regular schedule via email

You can send PDFs of reports and dashboards to interested parties on a regular schedule via email. The schedule can be any interval you require: Every hour, every day at midnight, weekly each Sunday at noon, and so on.

To send a PDF of a report to one or more recipients on a regular schedule via email, you'll use the Create Scheduled Search dialog when you create a search that returns useful results and have formatted it to appear in a pleasing manner. Just click Create and select Scheduled search... For more information, see "Schedule reports" in this manual.

To send a PDF of a dashboard to one or more recipients on a regular schedule via email, navigate to the dashboard and click Schedule PDF Delivery to open the Schedule PDF Delivery dialog. For more information see "Generate dashboard PDFs" in the Data Visualizations Manual.

Splunk also enables you to set up one-time email delivery of PDF-rendered search results with the sendemail search command. When you include this command in a search, you can arrange to have the search results sent in PDF format when you run the search. For details see the sendemail topic in the Search Reference. (Note that the sendemail command does not enable you to set up scheduled emails--it just sends an email of the search results whenever you run the search.)

Send PDFs with alert emails

You can design alerts that, when triggered, send emails with PDF attachments that show the results of the triggering search. For more information about the different kinds of alerts that you can design, read "About alerts" in the Alerting Manual.


Integrated PDF generation cannot:

  • Generate PDFs from dashboards that are built with advanced XML.
  • Generate scheduled PDFs from forms.
  • Print heat maps.

Dashboards and forms that use advanced XML aren't printed

If you want to print a dashboard that uses advanced XML, create a simple XML version of the dashboard. Simple XML supports a wide range of charting features, has dynamic drilldown capabilities, and supports post-process of searches in dashboards and forms. See the Dashboards and Visualizations manual for complete instructions on building dashboards using simple XML.

Scheduled forms won't be printed

Integrated PDF generation cannot print scheduled forms. You can only print one-off forms that have been constructed with simple XML.

Heat maps aren't printed

The heat map shading in a visualization doesn't appear in a PDF. The rest of the visualization, however, does appear in the generated PDF.

Real-time searches and integrated PDF generation

When you use integrated PDF generation to generate a PDF for a search, report, or dashboard panel that runs in real time, Splunk Enterprise converts the search to a historical search (essentially removing the "rt" from the time range). So if you have a real-time search with a 5 minute window, the PDF displays the result of this search as if it had only been run over the past 5 minutes relative to the moment the PDF was generated.

If your dashboard has panels that display results for searches with "real-time all time" time ranges, the PDF of that dashboard displays results for the same searches over all time.

Enable usage of non-latin fonts in PDFs

Splunk Enterprise comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how the CID fonts are loaded by making changes to the reportCIDFontList parameter in alert_actions.conf. If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list will be used. By default, reportCIDFontList = gb cns jp kor, which reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

If multiple fonts provide a glyph for a given character code the glyph from the first font specified in the list will be used. To skip loading any CID fonts, leave the value of reportCIDFontList blank.

If you want your PDFs to make use of another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk Enterprise admin add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, Splunk Enterprise will sort through them in alphabetical order. This means that if you have Cyrillic and Greek installed it will always choose Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so Greek comes first.

Additional configuration for integrated PDF generation

You can configure certain aspects of integrated PDF generation in limits.conf and alert_actions.conf.


In the [pdf] stanza you can set the max_rows_per_table to set the maximum number of table rows that Splunk Enterprise will print out for simple results tables in a PDF. The default is 1000.

Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard.

In the same stanza you can change the render_endpoint_timeout to a number other than the default 3600 seconds (1 hour). This controls the amount of time that Splunk Enterprise will wait to generate a PDF of a slow-completing search.


The reportIncludeSplunkLogo parameter for alert_actions.conf controls whether the Splunk Enterprise logo appears in the PDF footers. It is set to 1 (true) by default. If you don't want to see the Splunk Enterprise logo in your PDFs, set the value to 0 (false).

Print search results or a formatted report

If you are printing a set of search results or a formatted report (that displays a table or visualization), Splunk Enterprise prints it with integrated PDF generation.

You need to configure settings in Settings > Searches, reports, and alerts if you want to schedule delivery of PDFs by email or use the sendemail command.

System requirements

Supported operating systems:

  • Solaris (x86 only, not SPARC)
  • Linux Kernel vers. 2.6.x and above
  • Windows Server 2003/2003 R2 (64-bit), 2008/2008 R2 (64-bit)
  • Windows Vista (64-bit), XP, 7 (64-bit)
  • Mac OS X 10.5 and 10.6 on Intel Macs

Integrated PDF Generation is supported on any browser that Splunk Enterprise is also supported on. However, if you're using Internet Explorer, you will encounter fewer rendering issues if you also install Adobe Acrobat.


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about PDF generation.

Configure the priority of scheduled reports

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters