Generate PDFs of your reports and dashboards

To generate a dashboard PDF, you can click Export > Export PDF from the dashboard. For more information about this feature, see Generate dashboard PDFs in Dashboards and Visualizations.

You can view the PDF in your internet browser or with a separate PDF viewing application.

Schedule PDF email delivery

You can schedule email PDF delivery for reports and dashboards. You can configure the schedule for any regular time interval.

To schedule report PDF emails, use the Create Scheduled Search dialog. Click Create and select Scheduled search... For more information, see "Schedule reports" in this manual.

To schedule dashboard PDF emails, navigate to the dashboard and click Export > Schedule PDF Delivery from the dashboard to open the Schedule PDF Delivery dialog. For more information see "Generate dashboard PDFs" in the Data Visualizations Manual.

You can set up a single email delivery of PDF-rendered search results by using the sendemail search command. For details see the sendemail topic in the Search Reference.

• Note: the sendemail command does not enable you to set up scheduled emails for your results.

Send PDFs with alert emails

You can design alerts that, when triggered, send emails with PDF attachments showing the results of the triggering search.

For more information about the different kinds of alerts that you can design, read the Alerting Manual.

Real-time searches and integrated PDF generation

When you use integrated PDF generation to generate a PDF for a search, report, or dashboard panel that runs in real time, Splunk software converts the search to a historical search (essentially removing the "rt" from the time range). So if you have a real-time search with a 5 minute window, the PDF displays the result of this search as if it had only been run over the past 5 minutes relative to the moment the PDF was generated.

If your dashboard has panels that display results for searches with "real-time all time" time ranges, the PDF of that dashboard displays results for the same searches over all time.

Enable usage of non-Latin fonts in PDFs

Splunk software comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese. If you have Splunk Cloud and require additional fonts, file a Splunk Support ticket.

If you have Splunk Enterprise, you can control how the CID fonts are loaded by making changes to the reportCIDFontList parameter in alert_actions.conf. If multiple fonts provide a glyph for a given character code, the glyph from the first font specified in the list will be used. By default, reportCIDFontList = gb cns jp kor, which reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

If multiple fonts provide a glyph for a given character code the glyph from the first font specified in the list will be used. To skip loading any CID fonts, leave the value of reportCIDFontList blank.

If you want your PDFs to make use of another truetype, non-Latin font (such as Cyrillic or Greek) have your Splunk Enterprise admin add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, Splunk software will sort through them in alphabetical order. This means that if you have Cyrillic and Greek installed it will always choose Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so Greek comes first.

Additional configuration options for integrated PDF generation

There are several customization options for scheduled PDFs. They include settings for the following items.

• Header and footer display. You can choose whether to include a header and footer in your PDF. You can also configure positioning for elements within the header or footer to display them at left, right, or center.

• HTML image support. You can opt to render PNG or JPEG images that have HTML <img> tags. HTML image rendering may cause PDF generation issues. Opt out of image rendering if you encounter problems generating the PDF.

• Optional logo file location. You can substitute a logo image in place of the default Splunk logo that appears in a PDF header or footer. You can specify a path for the image file and adjust the logo position to left, right, or center.

You can configure these options using the Mail Server settings manager. Select Settings > Server settings > Email settings to locate the Mail Server Settings page. Scroll to the bottom of this page to find PDF Report Settings.

If you have Splunk Enterprise, you can also configure certain aspects of integrated PDF generation in limits.conf and alert_actions.conf.

Filename configuration in the app local directory

You can adjust the scheduled PDF file naming syntax in the alert_actions.conf file within the etc/apps/<app_name>/local directory. This changes the name of the PDF file attached to emails for scheduled delivery. For example, you can adjust PDF settings for the Search and Reporting app by editing etc/apps/search/local/alert_actions.conf.

By default, scheduled PDF filenames follow this convention: $type$-$name$-$time:%Y-%m-%d$.

For example, a default PDF filename can be dashboard-test-2015-01-15.pdf.

To change the default settings, you can specify tokens indicating the following information about the PDF.

Token	Supported values	Description
$type$	dashboard report alert	type of knowledge object for this PDF
$app$	app_id	app folder name, such as search
$owner$	owner	user who is scheduling the PDF
$name$	id of dashboard, report, or alert	use the id and not the label
$time$	triggered time of scheduled PDF	format according to Python's strftime library.

An example configuration setting in alert_actions.conf would look like the following.

[email]
reportFileName = $type$-$name$-$time:%Y-%m-%d$

• Note: It is important to make this change in the etc/apps/<app_name>/local/alert_actions.conf.

limits.conf

In the [pdf] stanza you can set the max_rows_per_table to set the maximum number of table rows that Splunk software will print out for simple results tables in a PDF. The default is 1000.

Note: This can lead to multi-page reports if your tables have lots and lots of rows. Reduce this number if you want to limit the number of pages that a table can generate for a PDF version of a dashboard.

In the same stanza you can change the render_endpoint_timeout to a number other than the default 3600 seconds (1 hour). This controls the amount of time that Splunk software waits to generate a PDF of a slow-completing search.

alert_actions.conf

The reportIncludeSplunkLogo parameter for alert_actions.conf controls whether the Splunk Enterprise logo appears in the PDF footers. It is set to 1 (true) by default. If you don't want to see the Splunk Enterprise logo in your PDFs, set the value to 0 (false).

Print search results or a formatted report

If you are printing a set of search results or a formatted report (that displays a table or visualization), Splunk software prints it with integrated PDF generation.

You need to configure settings in Settings > Searches, reports, and alerts if you want to schedule delivery of PDFs by email or use the sendemail command.

Exceptions to integrated PDF generation

There are some limitations to integrated PDF generation.

Use simple XML to design dashboards for printing

Only simple XML dashboards can be printed. Simple XML supports a wide range of charting features, has dynamic drilldown capabilities, and supports post-process of searches in dashboards and forms. See the Dashboards and Visualizations manual for complete instructions on building dashboards using simple XML.

Scheduled forms are not printed

Integrated PDF generation cannot print scheduled forms. You can only print one-off forms that have been constructed with simple XML.

System requirements

All operating systems that are supported by Splunk Enterprise support the ability to generate PDFs. For a complete list, see System requirements for use of Splunk Enterprise on-premises

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about PDF generation.