Generate PDFs of your reports and dashboards
Generate report and dashboard PDFs
To generate a dashboard PDF, you can click Generate PDF from the dashboard. For more information about this feature, see Generate dashboard PDFs in Dashboards and Visualizations.
You can view the PDF in your internet browser or with a separate PDF viewing application.
Schedule PDF email delivery
You can schedule email PDF delivery for reports and dashboards. You can configure the schedule for any regular time interval.
To schedule report PDF emails, use the Create Scheduled Search dialog. Click Create and select Scheduled search... For more information, see "Schedule reports" in this manual.
To schedule dashboard PDF emails, navigate to the dashboard and click Schedule PDF Delivery to open the Schedule PDF Delivery dialog. For more information see "Generate dashboard PDFs" in the Data Visualizations Manual.
You can set up a single email delivery of PDF-rendered search results by using the
sendemail search command. For details see the
sendemail topic in the Search Reference.
- Note: the
sendemailcommand does not enable you to set up scheduled emails for your results.
Send PDFs with alert emails
You can design alerts that, when triggered, send emails with PDF attachments showing the results of the triggering search.
For more information about the different kinds of alerts that you can design, read the Alerting Manual.
Real-time searches and integrated PDF generation
When you use integrated PDF generation to generate a PDF for a search, report, or dashboard panel that runs in real time, Splunk software converts the search to a historical search (essentially removing the "rt" from the time range). So if you have a real-time search with a 5 minute window, the PDF displays the result of this search as if it had only been run over the past 5 minutes relative to the moment the PDF was generated.
If your dashboard has panels that display results for searches with "real-time all time" time ranges, the PDF of that dashboard displays results for the same searches over all time.
Enable usage of non-Latin fonts in PDFs
Splunk software comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese. If you have Splunk Cloud and require additional fonts, file a Splunk Support ticket.
If you have Splunk Enterprise, you can control how the CID fonts are loaded by making changes to the
reportCIDFontList parameter in
alert_actions.conf. If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list will be used. By default,
reportCIDFontList = gb cns jp kor, which reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.
If multiple fonts provide a glyph for a given character code the glyph from the first font specified in the list will be used. To skip loading any CID fonts, leave the value of
If you want your PDFs to make use of another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk Enterprise admin add the Unicode font to
$SPLUNK_HOME/share/splunk/fonts. Create the
fonts directory if it doesn't already exist.
Note: When multiple fonts are installed, Splunk software will sort through them in alphabetical order. This means that if you have Cyrillic and Greek installed it will always choose Cyrillic unless you change the name of the files in
$SPLUNK_HOME/share/splunk/fonts so Greek comes first.
Additional configuration options for integrated PDF generation
There are several customization options for scheduled PDFs. They include settings for the following items.
- Header and footer display. You can choose whether to include a header and footer in your PDF. You can also configure positioning for elements within the header or footer to display them at left, right, or center.
- HTML image support. You can opt to render PNG or JPEG images that have HTML <img> tags. HTML image rendering may cause PDF generation issues. Opt out of image rendering if you encounter problems generating the PDF.
- Optional logo file location. You can substitute a logo image in place of the default Splunk logo that appears in a PDF header or footer. You can specify a path for the image file and adjust the logo position to left, right, or center.
You can configure these options using the Mail Server settings manager. Select Settings > Server settings > Email settings to locate the Mail Server Settings page. Scroll to the bottom of this page to find PDF Report Settings.
If you have Splunk Enterprise, you can also configure certain aspects of integrated PDF generation in
Filename configuration in the app local directory
You can adjust the scheduled PDF file naming syntax in the
alert_actions.conf file within the
etc/apps/<app_name>/local directory. This changes the name of the PDF file attached to emails for scheduled delivery. For example, you can adjust PDF settings for the Search and Reporting app by editing
By default, scheduled PDF filenames follow this convention:
For example, a default PDF filename can be dashboard-test-2015-01-15.pdf.
To change the default settings, you can specify tokens indicating the following information about the PDF.
||type of knowledge object for this PDF|
|$app$||app_id|| app folder name, such as |
|$owner$||owner||user who is scheduling the PDF|
|$name$||id of dashboard, report, or alert||use the id and not the label|
|$time$||triggered time of scheduled PDF||format according to Python's strftime library.|
An example configuration setting in
alert_actions.conf would look like the following.
[email] reportFileName = $type$-$name$-$time:%Y-%m-%d$
- Note: It is important to make this change in the
[pdf] stanza you can set the
max_rows_per_table to set the maximum number of table rows that Splunk software will print out for simple results tables in a PDF. The default is 1000.
Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard.
In the same stanza you can change the
render_endpoint_timeout to a number other than the default 3600 seconds (1 hour). This controls the amount of time that Splunk software waits to generate a PDF of a slow-completing search.
reportIncludeSplunkLogo parameter for
alert_actions.conf controls whether the Splunk Enterprise logo appears in the PDF footers. It is set to
1 (true) by default. If you don't want to see the Splunk Enterprise logo in your PDFs, set the value to
Print search results or a formatted report
If you are printing a set of search results or a formatted report (that displays a table or visualization), Splunk software prints it with integrated PDF generation.
You need to configure settings in Settings > Searches, reports, and alerts if you want to schedule delivery of PDFs by email or use the sendemail command.
Exceptions to integrated PDF generation
There are some limitations to integrated PDF generation.
Use simple XML to design dashboards for printing
Only simple XML dashboards can be printed. Simple XML supports a wide range of charting features, has dynamic drilldown capabilities, and supports post-process of searches in dashboards and forms. See the Dashboards and Visualizations manual for complete instructions on building dashboards using simple XML.
Scheduled forms are not printed
Integrated PDF generation cannot print scheduled forms. You can only print one-off forms that have been constructed with simple XML.
Supported operating systems:
- Solaris (x86 only, not SPARC)
- Linux Kernel vers. 2.6.x and above
- Windows Server 2003/2003 R2 (64-bit), 2008/2008 R2 (64-bit)
- Windows Vista (64-bit), XP, 7 (64-bit)
- Mac OS X 10.5 and 10.6 on Intel Macs
Integrated PDF generation is supported on any browser that Splunk Web is also supported on. However, if you're using Internet Explorer, you will encounter fewer rendering issues if you also install Adobe Acrobat.
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about PDF generation.
Offset scheduled search start times
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.6.0, 6.6.1, 6.6.2