Simple XML Dashboards - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 86

The documentation for simplified XML panels can be found by
searching splunk.com for Panel reference for simple XML .
UI Examples app
Before digging into the XML behind dashboards, it's a very good idea to install
the app Splunk UI examples app for 4.1+ , available from Splunkbase (see Chapter 7 ,
Working with Apps , for information about Splunkbase). The examples provided in
this app give a good overview of the features available in both simplified XML and
advanced XML dashboards.
The simplest way to find this app is by searching for examples in App | Find
more apps… .
Building forms
Forms allow you to make a template that needs one or more pieces of information
supplied to run. You can build these directly using raw XML, but I find it simpler
to build a simple dashboard and then modify the XML accordingly. The other
option is to copy an example, like those found in the UI Examples app (see the
UI Examples app section, earlier in this chapter). We will touch on a simple use
case in the following section.
Creating a form from a dashboard
First, let's think of a use case. How about a form that tells us about errors for a
particular user? Let's start with a report for a particular user, our friend mary :
sourcetype="impl_splunk_gen" error user="mary"
| stats count by logger