Implementing Splunk - Second Edition

Converting simple XML to advanced XML

Let's go back to one of the dashboards we created in Chapter 5, Simple XML Dashboards, errors_user_form.

We built this before our app, so it still lives in the Search app.

Just to refresh your memory, the simple XML code behind this dashboard looks as follows:

<?xml version='1.0' encoding='utf-8'?> <form> <fieldset> <input type="text" token="user"> <label>User</label> </input> <input type="time" /> </fieldset> <label>Errors User Form</label> <row> <chart> <searchString> sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network </searchString> <title> Dashboard - Errors - errors by network timechart </title> <option name="charting.chart">line</option> </chart> </row> ...