Converting simple XML to advanced XML
Let's go back to
one of the dashboards we created in Chapter 4, Simple XML Dashboards, errors_user_form
. We built this before our app, so it still lives in the Search app. In my instance, this URL is http://mysplunkserver:8000/en-US/app/search/errors_user_form
.
Just to refresh, the simple XML behind this dashboard looks like:
<?xml version='1.0' encoding='utf-8'?> <form> <fieldset> <input type="text" token="user"> <label>User</label> </input> <input type="time" /> </fieldset> <label>Errors User Form</label> <row> <chart> <searchString> sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network </searchString> <title> Dashboard - Errors - errors by network timechart </title> <option name="charting.chart">line<...