Implementing Splunk: Big Data Reporting and Development for Operational Intelligence

Converting simple XML to advanced XML

Let's go back to one of the dashboards we created in Chapter 4, Simple XML Dashboards, errors_user_form. We built this before our app, so it still lives in the Search app. In my instance, this URL is http://mysplunkserver:8000/en-US/app/search/errors_user_form.

Just to refresh, the simple XML behind this dashboard looks like:

<?xml version='1.0' encoding='utf-8'?> <form> <fieldset> <input type="text" token="user"> <label>User</label> </input> <input type="time" /> </fieldset> <label>Errors User Form</label> <row> <chart> <searchString> sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network </searchString> <title> Dashboard - Errors - errors by network timechart ...