Simple XML Dashboards - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 95

Let's make a few more changes:

1. Remove the Errors by user pie chart.

2. Add a time input to <fieldset> .

3. Remove the earliest and latest times from the queries. If a panel has time

specified, it will always take precedence over the time field specified in
<fieldset> .

Our XML now looks like this:

<?xml version='1.0' encoding='utf-8'?>
<form>
<label>Errors User Form</label>

<fieldset>
<input type="text" token="user">
<label>User</label>
</input>
<input type="time" />
</fieldset>
<row>
<chart>
<searchString>
sourcetype="impl_splunk_gen" loglevel=error user="$user$"
| timechart count as "Error count" by network
</searchString>
<title>Dashboard - Errors - errors by network timechart</title>
<!-- remove time specifier -->
<option name="charting.chart">line</option>
</chart>
</row>

<row>
<chart>
<searchString>
sourcetype="impl_splunk_gen" loglevel=error user="$user$"
| bucket bins=10 req_time | stats count by req_time
</searchString>
<title>Error count by req_times</title>
<!-- remove time specifier -->
<option name="charting.chart">pie</option>
</chart>