Simple XML Dashboards - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 90

4. Create a <fieldset> tag with any form elements.

<form>
<label>Chapter 4 Form 1</label>
<fieldset>
<input type="text" token="user">
<label>User</label>
</input>
</fieldset>
<row>

5. Add appropriate variables in <searchString> to reflect the form values.

<searchString>
sourcetype="impl_splunk_gen" error user="$user$"
| stats count by logger
</searchString>

When we're through, our XML looks like this:

<?xml version='1.0' encoding='utf-8'?>
<form>

<label>Chapter 4 Form 1</label>

<fieldset>
<input type="text" token="user">
<label>User</label>
</input>
</fieldset>

<row>
<table>
<searchString>
sourcetype="impl_splunk_gen" error user="$user$"
| stats count by logger</searchString>
<title>Dashboard - Chapter 4 Form 1 - error</title>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</table>
</row>

</form>