Splunk® Enterprise

Dashboards and Visualizations

Generate dashboard PDFs

This feature is deprecated.
Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards is deprecated in Splunk Enterprise as of version 9.4.0 and Splunk Cloud Platform as of 9.3.2408. Although this feature continues to function, it might be removed in a future version.


Alternatively, you can use the Dashboard Studio PDF generation. For more details, see Download and schedule email exports of dashboard content for sharing in the Dashboard Studio Manual.

Dashboard PDF generation includes the following options.

  • Generate and save a dashboard PDF.
  • Print dashboard PDFs.
  • Schedule PDF email delivery.

There are some limitations to PDF generation. See Limitations to PDF generation for details.

For information on sending scheduled report PDFs as email attachments, see Schedule reports in the Reporting Manual.

For dashboard PDF generation with Dashboard Studio, see Download and schedule email exports of dashboard content for sharing in the Dashboard Studio Manual.

Generate and print dashboard PDFs

Generate a dashboard PDF

  1. From the dashboard, select Export > Export PDF. The generated PDF appears in a browser window.
  2. View, download, or print the PDF from the browser window.


Print a dashboard PDF

  1. From the dashboard, select Export > Print. The default print driver for your browser opens with print settings.

Real-time searches and integrated PDF generation

PDF generation has special time range handling for real-time searches. PDFs for real-time searches, reports, or dashboards show results for the search time window relative to PDF generation time. As an example, when you generate a PDF for a real-time search with a five minute time window, the PDF shows search results for the past five minutes.

PDFs for dashboard panels with "real-time all time" search time ranges show results for the search over all time.


Schedule PDF delivery

This feature is deprecated.
Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards is deprecated in Splunk Enterprise as of version 9.4.0 and Splunk Cloud Platform as of 9.3.2408. Although this feature continues to function, it might be removed in a future version.


Alternatively, you can use the Dashboard Studio PDF generation. For more details, see Download and schedule email exports of dashboard content for sharing in the Dashboard Studio Manual.

Authorized users can schedule PDF delivery.

  • You must have the admin role to schedule a PDF email, using the sendemail command, to a mail server that requires SMTP authentication.
  • You must have the list_settings capability to schedule a PDF email, using the sendemail command, to a mail server that does not require SMTP authentication.
  • If you want to allow users not belonging to the admin, splunk-system-role, and can_delete roles to send email notifications using the sendemail command in their search, you must assign them the list_settings capability. Only the admin, splunk-system-role, and can_delete roles are assigned the list_settings capability by default.

For more information on roles and capabilities, see Define roles on the Splunk platform with capabilities in the Securing Splunk Enterprise Manual.

To set up PDF delivery, select Export > Schedule PDF delivery. Ensure that email notification settings are configured prior to scheduling PDF delivery. For more information on configuring alerts, see Configure email notification settings in the Alerting Manual.

Scheduled PDF delivery is not available for dashboards that include forms.

Use tokens in scheduled dashboard delivery

Splunk software provides tokens that you can use to include information generated by a search in the fields of an email. For scheduled PDF delivery, you can use tokens in the following fields of an email:

  • Subject
  • Message
  • Footer

Access the value of a token with the following syntax:

$<token-name>$

For example, place the following token in the subject field of a scheduled PDF delivery to reference the app containing the dashboard.

Search results from $app$

Tokens available for email notifications

You can use tokens to populate email notifications dynamically with search, server, or dashboard information.

See Use tokens in email notifications for details on dashboard metadata and other available tokens.

Schedule PDF delivery of a dashboard

Schedule PDF delivery of a dashboard:

  1. For the dashboard you want to schedule, select Export > Schedule PDF Delivery.
  2. Select the Schedule PDF Delivery check box to enable PDF delivery.
    7.1 schedule pdf.png
  3. Select a schedule.
    If you select Run on Cron Schedule see cron examples.
  4. Specify email details.
    You can use tokens in the Subject and Message fields.

    • To, CC, and BCC email recipients.
      Specify a comma-separated list of email recipients.
    • Priority
      Enforcement of priority depends on your email client.
    • Subject
    • Message
  5. Select Paper Size and Paper Layout.
  6. Click Save to save the schedule delivery settings.


To Discontinue a scheduled email delivery of a dashboard PDF

  1. For the dashboard you want to discontinue PDF delivery, select Export > Schedule PDF Delivery.
  2. Deselect the Schedule PDF Delivery.
  3. Click Save to save the schedule delivery settings.

Scheduled views reports

When you schedule a PDF for delivery, a report called a scheduled view is created. Scheduled views don't appear in Searches, Reports, and Alerts under Settings. They only appear as a stanza in savedsearches.conf. The naming convention for scheduled views is _ScheduledView_<dashboard_name>, where dashboard_name is the name of the corresponding dashboard. It's a best practice to monitor the number of searches that are running to generate these dashboards, especially if you are experiencing problems with concurrent search limits for your deployment.

When a dashboard is deleted, the corresponding scheduled view is orphaned, but still present. By default, orphaned scheduled views are deleted every 24 hours. If you want to change the frequency of the setting, or disable it, you can use the following settings in limits.conf.

Setting Description Default
enable_reaper = <boolean> Controls whether the scheduled views reaper runs. The reaper deletes orphaned scheduled views. true
reaper_freq = <integer> Controls how often, in seconds, the scheduled views reaper runs. 86400 (24 hours).


Never make changes to the configuration files in the default directory. For information on how to edit configuration files, see About configuration files.

Specify a cron schedule for PDF delivery

You can use cron notation to define a custom delivery schedule. Select the Cron option to input a schedule.

Cron parameters
When specifying a cron expression, only five cron parameters are available, not six. The sixth parameter for year, common in other forms of cron notation, is not available.

The cron parameters, * * * * *, correspond to minute hour day month day-of-week.


Example expressions
Here are some example cron expressions. 

*/5 * * * *       Every 5 minutes.
*/30 * * * *      Every 30 minutes.
0 */12 * * *      Every 12 hours, on the hour.
*/20  * * * 1-5   Every 20 minutes, Monday through Friday.
0 9 1-7 * 1       First Monday of each month, at 9am.

Additional configurations for PDF printing

This feature is deprecated.
Exporting dashboard PDFs, scheduling PDF delivery, and printing PDFs with Classic Simple XML dashboards is deprecated in Splunk Enterprise as of version 9.4.0 and Splunk Cloud Platform as of 9.3.2408. Although this feature continues to function, it might be removed in a future version.


Alternatively, you can use the Dashboard Studio PDF generation. For more details, see Download and schedule email exports of dashboard content for sharing in the Dashboard Studio Manual.

Splunk Enterprise users can specify the following configurations for PDF printing.

  • Maximum number of table rows to print
  • Timeout setting for generating a PDF
  • Whether to include a logo
  • Enable usage of non-Latin fonts

Note: If you are using Splunk Cloud Platform and want these settings changed, file a Support ticket.


Configure the number of rows in a table

By default, 1000 rows are generated for a simple results table in a dashboard panel. If you have a dashboard with a table that has more than 1000 rows, the initial 1000 rows are rendered for the PDF, printing the results across several pages if necessary.

Splunk Enterprise users can override the default number of rows generated for PDF in the limits.conf file.

To configure the maximum number of rows in a table that can be printed in PDF:

  1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
    Create this file if it does not already exist.
  2. Specify the following property in the [pdf] stanza:
[pdf]
max_rows_per_table = <unsigned int>
Note: This setting configures PDF settings for all tables in your Splunk deployment.

Configure the timeout setting for generating a PDF

The default timeout for generating a PDF is 3600 seconds, as specified in limits.conf. A complex search that is slow to completion might need additional time to generate the PDF.

To configure the timeout for generating a PDF:

  1. Open $SPLUNK_HOME/etc/system/local/limits.conf for editing.
    Create this file if it does not already exist.
  2. Specify the number of seconds to wait to generate a PDF. This property is in the [pdf] stanza:
[pdf]
render_endpoint_timeout = <unsigned int>
Note: This setting configures PDF generation timeout settings for all PDFs in your Splunk deployment.

Configure whether to include the Splunk logo for a PDF

By default, the Splunk logo is included in a generated PDF. You can override the default setting in alert_actions.conf.

To not include the Splunk logo in a generated PDF:

  1. Open $SPLUNK_HOME/etc/system/local/alert_actions.conf for editing.
    Create this file if it does not already exist.
  2. Specify the following property in the [email] stanza:
[email]
reportIncludeSplunkLogo=0
Note: This setting configures settings for all generated PDFs in your Splunk deployment.

Enable usage of non-Latin fonts in PDFs

Splunk software comes prepackaged with a collection of Latin fonts, and also a set of CID fonts for handling Japanese, Korean, Simplified Chinese, and Traditional Chinese.

You can control how Splunk software loads the CID fonts by making changes to the reportCIDFontList parameter in alert_actions.conf. Specify fonts in a space-separated list. If multiple fonts provide a glyph for a given character code, the glyph from the first font in the list is used.

The reportCIDFontList parameter is in the [email] stanza. Make any changes for font usage here:

$SPLUNK_HOME/etc/system/local/alert_actions.conf

Here are the CID fonts supported by default:

gb cns jp kor

These reference Simplified Chinese, Traditional Chinese, Japanese, and Korean respectively.

To skip loading any CID fonts, in the local version of alert_actions.conf, leave the value of reportCIDFontList blank.

If you want your PDFs to use another non-Latin font (such as Cyrillic or Greek) ask an administrator add the Unicode font to $SPLUNK_HOME/share/splunk/fonts. Create the fonts directory if it doesn't already exist.

Note: When multiple fonts are installed, they are sorted by name in alphabetical order. For example, If you have Cyrillic and Greek installed, Splunk software always chooses Cyrillic unless you change the name of the files in $SPLUNK_HOME/share/splunk/fonts so that Greek comes first.

Limitations to PDF generation

Integrated PDF generation functionality has a few limitations.

  • PDFs in languages, such as Hebrew, where text should appear in right to left order, are rendered with text in left to right order.
  • PDFs for dashboards with multiple panels in a row might generate with only a single panel per row.
  • PDF generation works only with dashboards built with Simple XML.
  • You cannot generate scheduled PDFs of dashboards that include the following:
    • Tokens set by inputs
    • The <init> element
    • The <set> element
  • You cannot generate PDFs for forms.
  • You cannot generate PDFs for custom visualizations.
  • You cannot generate PDFs for visualizations using the trellis layout.
  • PDF generation ignores charting customizations that are not supported by the JSChart charting library. The finished PDF displays the panels as rendered in JSChart with the unsupported customizations removed.
  • Dark theme is not supported for this operation. Dashboards saved in dark theme will switch to light theme when exported to PDF.
Last modified on 16 October, 2024
Manage dashboards that need jQuery updates   Clone and manage dashboards

This documentation applies to the following versions of Splunk® Enterprise: 9.4.0

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters