Converting simple XML to advanced XML

Let's go back to one of the dashboards we created in Chapter 4, Simple XML Dashboards, errors_user_form. We built this before our app, so it still lives in the Search app. In my instance, this URL is http://mysplunkserver:8000/en-US/app/search/errors_user_form.

Just to refresh, the simple XML behind this dashboard looks like:

<?xml version='1.0' encoding='utf-8'?> <form> <fieldset> <input type="text" token="user"> <label>User</label> </input> <input type="time" /> </fieldset> <label>Errors User Form</label> <row> <chart> <searchString> sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network </searchString> <title> Dashboard - Errors - errors by network timechart ...

Get Implementing Splunk now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.