Advanced XML structure

Before we dig into the modules provided, let's look at the structure of XML itself and cover a couple of concepts.

The tag structure of an advanced XML document is essentially as follows:

view 
module 
param 
... 
module 
... 

The main concept of Splunk's XML structure is that the effects of the upper modules flow downstream to the child modules.

This is a vital concept to understand. The XML structure has almost nothing to do with layout and everything to do with the flow of data.

Let's look at the following simple example:

<view 
template="dashboard.html"> 
<label>Chapter 9, Example 1</label> 
<module 
name="HiddenSearch" 
layoutPanel="panel_row1_col1" 
autoRun="True"> 
<param name="earliest">-99d</param> 
<param name="search">error | top user</param> 
<module name="SimpleResultsTable"></module> 
</module> 
</view> 

This document produces the following sparse dashboard with one panel:

Let's step through...