Splunk® Enterprise

Dashboards and Visualizations

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Generate dashboard PDFs

Dashboard PDF generation includes the following options.

  • Generate and save a dashboard PDF.
  • Print dashboard PDFs.
  • Schedule PDF email delivery.

There are some limitations to PDF generation. See "Limitations to PDF generation" for details.

For information on sending scheduled report PDFs as email attachments, see "Schedule reports", in the Reporting Manual.

Generate and print dashboard PDFs

Generate a dashboard PDF

  1. From the dashboard, click Export PDF. The generated PDF appears in a browser window.
  2. View, download, or print the PDF from the browser window.


Print a dashboard PDF

  1. From the dashboard, click Print. The default print driver for your browser opens with print settings.

Real-time searches and integrated PDF generation

PDF generation has special time range handling for real-time searches. PDFs for real-time searches, reports, or dashboards show results for the search time window relative to PDF generation time. As an example, when you generate a PDF for a real-time search with a five minute time window, the PDF shows search results for the past five minutes.

PDFs for dashboard panels with "real-time all time" search time ranges show results for the search over all time.


Schedule PDF delivery

Authorized users can schedule PDF delivery for dashboards. To set up PDF delivery, use the dashboard Edit menu to schedule delivery. You can access the Edit menu directly from a dashboard or from the Dashboards page. Ensure that email notification settings are configured prior to scheduling PDF delivery.

For more information, see "Configure email notification settings" in the Alerting Manual.

  • Note: Scheduled PDF delivery is not available for dashboards that include forms or for dashboards converted to HTML.


Use tokens in scheduled dashboard delivery

Splunk software provides tokens that you can use to include information generated by a search in the fields of an email. For scheduled PDF delivery, you can use tokens in the following fields of an email:

  • Subject
  • Message
  • Footer

Access the value of a token with the following syntax:

$<token-name>$

For example, place the following token in the subject field of a scheduled PDF delivery to reference the app containing the dashboard.

Search results from $app$

Tokens available for email notifications

This section lists common tokens you can use in scheduled email delivery of dashboards. There are four categories of tokens that access data generated from a search. The context for using the tokens differ.

The following table lists all categories of tokens. For scheduling PDF delivery, only the categories Search metadata and Server information apply.

Category Description Context
Search metadata Information about the search. Scheduled PDF delivery of dashboards
Alert actions from search
Scheduled reports
Server information Information about the Splunk Enterprise server Scheduled PDF delivery of dashboards
Alert actions from search
Scheduled reports
Search results Access results of a search Alert actions from search
Scheduled reports
Job information Data specific to a search job Alert actions from search
Scheduled reports

In addition to the common tokens listed in this topic, the savedsearches.conf configuration file lists attributes whose values are available from tokens. To access these additional attribute values, place the attribute between the '$' token delimiters.

Tokens that access search metadata

Common tokens that access information about a search. These tokens are available for the scheduled PDF delivery of dashboards.

The following table lists some of the common tokens that are available.

Token Description
$action.email.hostname$ Hostname of the email server.
$action.email.priority$ Priority of the email delivery.
$app$ Name of the app containing the dashboard.
$cron_schedule$ Cron schedule for PDF delivery.
$description$ Description of the dashboard.
$name$ Name of the dashboard.
$next_scheduled_time$ The next time the search runs.
$owner$ Owner of the dashboard.
$type$ Indicates if the search is from an alert, report, dashboard, or the search command.
$view_link$ Link to view the dashboard.

Tokens available from server

Common tokens that provide details available from your Splunk Enterprise server. These tokens are available for the scheduled PDF delivery of dashboards.

The following table lists some of the common tokens that are available.

Token Description
$server.build$ Build number of the Splunk Enterprise instance.
$server.serverName$ Server name hosting the Splunk Enterprise instance.
$server.version$ Version number of the Splunk Enterprise instance.

Schedule PDF delivery of a dashboard

To schedule PDF delivery of a dashboard:

  1. For the dashboard you want to schedule, select Edit > Schedule PDF Delivery.
  2. Select the Schedule PDF Delivery check box to enable PDF delivery.
    Viz schedule PDF.png
  3. Select a schedule
    If you select Run on Cron Schedule see cron examples.
  4. Specify email details.
    You can use tokens in the Subject and Message fields.

    • To, CC, and BCC email recipients.
      Specify a comma-separated list of email recipients.
    • Priority
      Enforcement of priority depends on your email client.
    • Subject
    • Message
  5. Select Paper Size and Paper Layout.
  6. Click Save to save the schedule delivery settings.


To Discontinue a scheduled email delivery of a dashboard PDF

  1. For the dashboard you want to discontinue PDF delivery, select Edit > Schedule PDF Delivery.
  2. Deselect the Schedule PDF Delivery.
  3. Click Save to save the schedule delivery settings.

Specify a cron schedule for PDF delivery

You can use standard cron notation to define a custom delivery schedule. When you select the Cron option, a field appears in which you can enter the cron schedule.

Note: Splunk Enterprise uses five parameters for cron notation, not six. Splunk Enterprise does not use the sixth parameter for year, common in other forms of cron notation.

The following parameters:

(* * * * *)

correspond to:

minute hour day month day-of-week.

Here are some cron examples:

*/5 * * * *       : Every 5 minutes
*/30 * * * *      : Every 30 minutes
0 */12 * * *      : Every 12 hours, on the hour
*/20  * * * 1-5   : Every 20 minutes, Monday through Friday
0 9 1-7 * 1       : First Monday of each month, at 9am.

Additional configurations for PDF printing

You can specify the following configurations for PDF printing:

  • Maximum number of table rows to print
  • Timeout setting for generating a PDF
  • Whether to include the Splunk logo
  • Enable usage of non-latin fonts

Configure the number of rows in a table

By default, 1000 rows are generated for a simple results table in a dashboard panel. If you have a dashboard with a table that has more than 1000 rows, the initial 1000 rows are rendered for the PDF, printing the results across several pages if necessary.

You can override the default number of rows generated for PDF in the limits.conf file.

To configure the maximum number of rows in a table that can be printed in PDF:

  1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
    Create this file if it does not already exist.
  2. Specify the following property in the [pdf] stanza:
[pdf]
max_rows_per_table = <unsigned int>
Note: This setting configures PDF settings for all tables in your Splunk instance.

Configure the timeout setting for generating a PDF

The default timeout for generating a PDF is 3600 seconds, as specified in limits.conf. A complex search that is slow to completion might need additional time to generate the PDF.

To configure the timeout for generating a PDF:

  1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
    Create this file if it does not already exist.
  2. Specify the number of seconds to wait to generate a PDF. This property is in the [pdf] stanza:
[pdf]
render_endpoint_timeout = <unsigned int>
Note: This setting configures PDF generation timeout settings for all PDFs in your Splunk instance.

Configure whether to include the Splunk logo for a PDF

By default, the Splunk logo is included in a generated PDF. You can override the default setting in alert_actions.conf.

To not include the Splunk logo in a generated PDF:

  1. Open $SPLUNK_HOME/etc/system/local/alert_actions.conf for editing.
    Create this file if it does not already exist.
  2. Specify the following property in the [email] stanza:
[email]
reportIncludeSplunkLogo=0
Note: This setting configures settings for all generated PDFs in your Splunk instance.

Enable usage of non-Latin fonts in PDFs

Splunk software comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how Splunk software loads the CID fonts by making changes to the reportCIDFontList parameter in alert_actions.conf. Specify fonts in a space-separated list. If multiple fonts provide a glyph for a given character code, Splunk uses the glyph from the first font specified in the list.

The reportCIDFontList parameter is in the [email] stanza. Make any changes for font usage here:

$SPLUNK_HOME/etc/system/local/alert_actions.conf

Here are the CID fonts supported by default:

gb cns jp kor

These reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

To skip loading any CID fonts, in the local version of alert_actions.conf, leave the value of reportCIDFontList blank.

If you want your PDFs to use another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk administrator add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, they are sorted by name in alphabetical order. For example, If you have Cyrillic and Greek installed, Splunk software always chooses Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so that Greek comes first.

Limitations to PDF generation

Integrated PDF generation functionality has a few limitations.

  • PDFs in languages, such as Hebrew, where text should appear in right to left order, are rendered with text in left to right order.
  • PDFs for dashboards with multiple panels in a row might generate with only a single panel per row.
  • You cannot generate PDFs of dashboards that are built using advanced XML or HTML. PDF generation works only with dashboards built with simple XML.
  • You cannot generate PDFs for forms.
  • PDF generation ignores charting customizations that are not supported by the JSChart charting library. The finished PDF displays the panels as rendered in JSChart with the unsupported customizations removed.
PREVIOUS
Convert a dashboard to HTML
  NEXT
About editing simple XML

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Comments

Hi @Grundsch,
Thank you for your comment! You are correct--PDF generation supports heat maps. I have updated the docs to reflect that this is no longer a limitation as of 6.3.0.

Frobinson splunk, Splunker
November 30, 2015

It looks like as per version 6.3.1, PDF generation supports heat maps.

Grundsch
November 25, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters