Generate dashboard PDFs

Dashboard PDF generation includes the following options.

• Generate and save a dashboard PDF.
• Print dashboard PDFs.
• Schedule PDF email delivery.

There are some limitations to PDF generation. See "Limitations to PDF generation" for details.

For information on sending scheduled report PDFs as email attachments, see "Schedule reports", in the Reporting Manual.

Generate and print dashboard PDFs

Generate a dashboard PDF

1. From the dashboard, select Export > Export PDF. The generated PDF appears in a browser window.
2. View, download, or print the PDF from the browser window.

Print a dashboard PDF

1. From the dashboard, select Export > Print. The default print driver for your browser opens with print settings.

Real-time searches and integrated PDF generation

PDF generation has special time range handling for real-time searches. PDFs for real-time searches, reports, or dashboards show results for the search time window relative to PDF generation time. As an example, when you generate a PDF for a real-time search with a five minute time window, the PDF shows search results for the past five minutes.

PDFs for dashboard panels with "real-time all time" search time ranges show results for the search over all time.

Schedule PDF delivery

Authorized users can schedule PDF delivery for dashboards. To set up PDF delivery, select Export > Schedule PDF delivery. Ensure that email notification settings are configured prior to scheduling PDF delivery.

For more information, see Configure email notification settings in the Alerting Manual.

Note: Scheduled PDF delivery is not available for dashboards that include forms or for dashboards converted to HTML.

Use tokens in scheduled dashboard delivery

Splunk software provides tokens that you can use to include information generated by a search in the fields of an email. For scheduled PDF delivery, you can use tokens in the following fields of an email:

• Subject
• Message
• Footer

Access the value of a token with the following syntax:

$<token-name>$

For example, place the following token in the subject field of a scheduled PDF delivery to reference the app containing the dashboard.

Search results from $app$

Tokens available for email notifications

You can use tokens to populate email notifications dynamically with search, server, or dashboard information.

See Use tokens in email notifications for details on dashboard metadata and other available tokens.

Schedule PDF delivery of a dashboard

To schedule PDF delivery of a dashboard:

1. For the dashboard you want to schedule, select Export > Schedule PDF Delivery.
2. Select the Schedule PDF Delivery check box to enable PDF delivery.
   
3. Select a schedule
   If you select Run on Cron Schedule see cron examples.
4. Specify email details.
   You can use tokens in the Subject and Message fields.
   
   
   • To, CC, and BCC email recipients.
     Specify a comma-separated list of email recipients.
   • Priority
     Enforcement of priority depends on your email client.
   • Subject
   • Message
5. Select Paper Size and Paper Layout.
6. Click Save to save the schedule delivery settings.

To Discontinue a scheduled email delivery of a dashboard PDF

1. For the dashboard you want to discontinue PDF delivery, select Export > Schedule PDF Delivery.
2. Deselect the Schedule PDF Delivery.
3. Click Save to save the schedule delivery settings.

Scheduled views reports

When you schedule a PDF for delivery, a report called a scheduled view is created. Scheduled view reports don't appear in Searches, Reports, and Alerts under Settings; they only appear as a stanza in savedsearches.conf. The naming convention for these reports is _ScheduledView_<dashboard_name>, where dashboard_name is the name of the corresponding dashboard. You should monitor how many of these searches are running, and consider manually deleting them, if you are experiencing problems with concurrent search limits for your deployment.

Specify a cron schedule for PDF delivery

You can use cron notation to define a custom delivery schedule. Select the Cron option to input a schedule.

Cron parameters
When specifying a cron expression, only five cron parameters are available, not six. The sixth parameter for year, common in other forms of cron notation, is not available.

The cron parameters, * * * * *, correspond to minute hour day month day-of-week.

Example expressions
Here are some example cron expressions.

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20  * * * 1-5   Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9am.

Additional configurations for PDF printing

Splunk Enterprise users can specify the following configurations for PDF printing.

• Maximum number of table rows to print
• Timeout setting for generating a PDF
• Whether to include a logo
• Enable usage of non-Latin fonts

Note: If you are using Splunk Cloud and want these settings changed, file a Support ticket.

Configure the number of rows in a table

By default, 1000 rows are generated for a simple results table in a dashboard panel. If you have a dashboard with a table that has more than 1000 rows, the initial 1000 rows are rendered for the PDF, printing the results across several pages if necessary.

Splunk Enterprise users can override the default number of rows generated for PDF in the limits.conf file.

To configure the maximum number of rows in a table that can be printed in PDF:

1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
   Create this file if it does not already exist.
2. Specify the following property in the [pdf] stanza:

[pdf]
max_rows_per_table = <unsigned int>

Note: This setting configures PDF settings for all tables in your Splunk deployment.

Configure the timeout setting for generating a PDF

The default timeout for generating a PDF is 3600 seconds, as specified in limits.conf. A complex search that is slow to completion might need additional time to generate the PDF.

To configure the timeout for generating a PDF:

1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
   Create this file if it does not already exist.
2. Specify the number of seconds to wait to generate a PDF. This property is in the [pdf] stanza:

[pdf]
render_endpoint_timeout = <unsigned int>

Note: This setting configures PDF generation timeout settings for all PDFs in your Splunk deployment.

Configure whether to include the Splunk logo for a PDF

By default, the Splunk logo is included in a generated PDF. You can override the default setting in alert_actions.conf.

To not include the Splunk logo in a generated PDF:

1. Open $SPLUNK_HOME/etc/system/local/alert_actions.conf for editing.
   Create this file if it does not already exist.
2. Specify the following property in the [email] stanza:

[email]
reportIncludeSplunkLogo=0

Note: This setting configures settings for all generated PDFs in your Splunk deployment.

Enable usage of non-Latin fonts in PDFs

Splunk software comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how Splunk software loads the CID fonts by making changes to the reportCIDFontList parameter in alert_actions.conf. Specify fonts in a space-separated list. If multiple fonts provide a glyph for a given character code, the glyph from the first font in the list is used.

The reportCIDFontList parameter is in the [email] stanza. Make any changes for font usage here:

$SPLUNK_HOME/etc/system/local/alert_actions.conf

Here are the CID fonts supported by default:

gb cns jp kor

These reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

To skip loading any CID fonts, in the local version of alert_actions.conf, leave the value of reportCIDFontList blank.

If you want your PDFs to use another non-Latin font (such as Cyrillic or Greek) ask an administrator add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, they are sorted by name in alphabetical order. For example, If you have Cyrillic and Greek installed, Splunk software always chooses Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so that Greek comes first.

Limitations to PDF generation

Integrated PDF generation functionality has a few limitations.

• PDFs in languages, such as Hebrew, where text should appear in right to left order, are rendered with text in left to right order.
• PDFs for dashboards with multiple panels in a row might generate with only a single panel per row.
• You cannot generate PDFs of dashboards that are built using advanced XML or HTML. PDF generation works only with dashboards built with simple XML.
• You cannot generate PDFs for forms.
• PDF generation ignores charting customizations that are not supported by the JSChart charting library. The finished PDF displays the panels as rendered in JSChart with the unsupported customizations removed.