Generate dashboard PDFs

Dashboard PDF generation includes the following options.

• Generate and save a dashboard PDF.
• Print dashboard PDFs.
• Schedule PDF email delivery.

There are some limitations to PDF generation. See Limitations to PDF generation for details.

For information on sending scheduled report PDFs as email attachments, see Schedule reports in the Reporting Manual.

Generate and print dashboard PDFs

Generate a dashboard PDF

1. From the dashboard, select Export > Export PDF. The generated PDF appears in a browser window.
2. View, download, or print the PDF from the browser window.

Print a dashboard PDF

1. From the dashboard, select Export > Print. The default print driver for your browser opens with print settings.

Real-time searches and integrated PDF generation

PDF generation has special time range handling for real-time searches. PDFs for real-time searches, reports, or dashboards show results for the search time window relative to PDF generation time. As an example, when you generate a PDF for a real-time search with a five minute time window, the PDF shows search results for the past five minutes.

PDFs for dashboard panels with "real-time all time" search time ranges show results for the search over all time.

Schedule PDF delivery

Authorized users can schedule PDF delivery for dashboards, which includes sending emails with a search.

To send an email notification to a mail server that requires SMTP authentication, you must have the following roles:

• admin for Splunk Enterprise
• sc_admin for Splunk Cloud Platform

To send an email notification to a mail server that does not require SMTP authentication, you need the list_settings capability. The following roles are assigned the list_settings capability by default:

• admin for Splunk Enterprise
• sc_admin for Splunk Cloud Platform
• splunk-system-role
• can_delete

If you want users not belonging to any of these roles to send email notifications using the sendemail command in their search, you must assign them the list_settings capability. For more information on roles and capabilities, see "About defining roles with capabilities" in the Securing Splunk Enterprise Manual.

To set up PDF delivery, select Export > Schedule PDF delivery. Ensure that email notification settings are configured before scheduling PDF delivery.

For more information on configuring alerts, see Configure email notification settings in the Alerting Manual.

Scheduled PDF delivery is not available for dashboards that include forms or for dashboards converted to HTML.

Use tokens in scheduled dashboard delivery

Splunk software provides tokens that you can use to include information generated by a search in the fields of an email. For scheduled PDF delivery, you can use tokens in the following fields of an email:

• Subject
• Message
• Footer

Access the value of a token with the following syntax:

$<token-name>$

For example, place the following token in the subject field of a scheduled PDF delivery to reference the app containing the dashboard.

Search results from $app$

Tokens available for email notifications

You can use tokens to populate email notifications dynamically with search, server, or dashboard information.

See Use tokens in email notifications for details on dashboard metadata and other available tokens.

Schedule PDF delivery of a dashboard

Schedule PDF delivery of a dashboard:

1. For the dashboard you want to schedule, select Export > Schedule PDF Delivery.
2. Select the Schedule PDF Delivery check box to enable PDF delivery.
   
3. Select a schedule.
   If you select Run on Cron Schedule see cron examples.
4. Specify email details.
   You can use tokens in the Subject and Message fields.
   
   
   • To, CC, and BCC email recipients.
     Specify a comma-separated list of email recipients.
   • Priority
     Enforcement of priority depends on your email client.
   • Subject
   • Message
5. Choose a Paper Size and Paper Layout.
6. Select Save to save the schedule delivery settings.

To Discontinue a scheduled email delivery of a dashboard PDF

1. For the dashboard you want to discontinue PDF delivery, select Export > Schedule PDF Delivery.
2. Deselect the Schedule PDF Delivery.
3. Select Save to save the schedule delivery settings.

Scheduled views reports

When you schedule a PDF for delivery, a report called a scheduled view is created. Scheduled views don't appear in Searches, Reports, and Alerts under Settings. They only appear as a stanza in savedsearches.conf. The naming convention for scheduled views is _ScheduledView_<dashboard_name>, where dashboard_name is the name of the corresponding dashboard. It's a best practice to monitor the number of searches that are running to generate these dashboards, especially if you are experiencing problems with concurrent search limits for your deployment.

When a dashboard is deleted, the corresponding scheduled view is orphaned, but still present. By default, orphaned scheduled views are deleted every 24 hours. If you want to change the frequency of the setting, or disable it, you can use the following settings in limits.conf.

Setting	Description	Default
enable_reaper = <boolean>	Controls whether the scheduled views reaper runs. The reaper deletes orphaned scheduled views.	true
reaper_freq = <integer>	Controls how often, in seconds, the scheduled views reaper runs.	86400 (24 hours).

Never make changes to the configuration files in the default directory. For information on how to edit configuration files, see About configuration files.

Specify a cron schedule for PDF delivery

You can use cron notation to define a custom delivery schedule. Select the Cron option to input a schedule.

Cron parameters
When specifying a cron expression, only five cron parameters are available, not six. The sixth parameter for year, common in other forms of cron notation, is not available.

The cron parameters, * * * * *, correspond to minute hour day month day-of-week.

Example expressions
Here are some example cron expressions.

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20  * * * 1-5   Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9am.

Additional configurations for PDF printing

Splunk Enterprise users can specify the following configurations for PDF printing.

• Maximum number of table rows to print
• Timeout setting for generating a PDF
• Whether to include a logo
• Enable usage of non-Latin fonts

Note: If you are using Splunk Cloud Platform and want these settings changed, file a Support ticket.

Configure the number of rows in a table

By default, 1000 rows are generated for a simple results table in a dashboard panel. If you have a dashboard with a table that has more than 1000 rows, the initial 1000 rows are rendered for the PDF, printing the results across several pages if necessary.

Splunk Enterprise users can override the default number of rows generated for PDF in the limits.conf file.

To configure the maximum number of rows in a table that can be printed in PDF:

1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
   Create this file if it does not already exist.
2. Specify the following property in the [pdf] stanza:

[pdf]
max_rows_per_table = <unsigned int>

Note: This setting configures PDF settings for all tables in your Splunk deployment.

Configure the timeout setting for generating a PDF

The default timeout for generating a PDF is 3600 seconds, as specified in limits.conf. A complex search that is slow to completion might need additional time to generate the PDF.

To configure the timeout for generating a PDF:

1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
   Create this file if it does not already exist.
2. Specify the number of seconds to wait to generate a PDF. This property is in the [pdf] stanza:

[pdf]
render_endpoint_timeout = <unsigned int>

Note: This setting configures PDF generation timeout settings for all PDFs in your Splunk deployment.

Configure whether to include the Splunk logo for a PDF

By default, the Splunk logo is included in a generated PDF. You can override the default setting in alert_actions.conf.

To not include the Splunk logo in a generated PDF:

1. Open $SPLUNK_HOME/etc/system/local/alert_actions.conf for editing.
   Create this file if it does not already exist.
2. Specify the following property in the [email] stanza:

[email]
reportIncludeSplunkLogo=0

Note: This setting configures settings for all generated PDFs in your Splunk deployment.

Configure whether to include the View dashboard link

The View dashboard link connects to the dashboard's associated Splunk instance by default. Only users with permission to access the instance will open the link successfully.

The following steps describe how to remove the View dashboard link:

1. Navigate to Searches, reports, and alerts in the Settings list.
2. Find your PDF delivery schedule in the Searches, reports, and alerts list.
   1. Your schedule name will begin with _ScheduledView__ and follow the convention _ScheduledView__<dashboard_id>.
3. Select the Edit list next to your schedule. You can find the Edit list under the Actions column.
4. Deselect Link to Report in the Include section.
5. Select Save.

Enable usage of non-Latin fonts in PDFs

Splunk software comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how Splunk software loads the CID fonts by making changes to the reportCIDFontList parameter in alert_actions.conf. Specify fonts in a space-separated list. If multiple fonts provide a glyph for a given character code, the glyph from the first font in the list is used.

The reportCIDFontList parameter is in the [email] stanza. Make any changes for font usage here:

$SPLUNK_HOME/etc/system/local/alert_actions.conf

Here are the CID fonts supported by default:

gb cns jp kor

These reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

To skip loading any CID fonts, in the local version of alert_actions.conf, leave the value of reportCIDFontList blank.

If you want your PDFs to use another non-Latin font (such as Cyrillic or Greek) ask an administrator add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, they are sorted by name in alphabetical order. For example, If you have Cyrillic and Greek installed, Splunk software always chooses Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so that Greek comes first.

Limitations to PDF generation

Integrated PDF generation functionality has a few limitations.

• PDFs in languages, such as Hebrew, where text should appear in right to left order, are rendered with text in left to right order.
• PDFs for dashboards with multiple panels in a row might generate only a single panel per row.
• You cannot generate PDFs of dashboards that are built using advanced XML or HTML. PDF generation works only with dashboards built with Simple XML.
• You cannot generate scheduled PDFs of dashboards that include the following:
  • Tokens set by inputs
  • The <init> element
  • The <set> element
• You cannot generate PDFs for forms.
• You cannot generate a trellis layout in PDFs.
• PDF generation ignores charting customizations that the JSChart charting library does not support. The finished PDF displays the panels as rendered in JSChart with the unsupported customizations removed.
• Dark theme is not supported for this operation. Dashboards saved in dark theme will switch to light theme when exported to PDF.
• PDFs might not render labels on the x-axis depending on the length of each label and the orientation of the PDF. If x-axis labels do not display, reduce the number of labels by increasing the interval between tick marks on the x-axis.