I want to figure out how to put in a search bar that lets users look for "Telephone Numbers" and another that lets me look for "usernames." I have been looking at the how to add forms to searches document, but i do not seem to be getting anywhere with my XML. Would anyone have any advice on how to solve this problem?
<?xml version='1.0' encoding='utf-8'?>
You can't do it with the <dashboard>
syntax. However there's another similar flavor of 'simplified XML' where the top tag is <form>
. The rules are a bit different inside the <form>
views, from what you're used to in <dashboard>
however they are pretty similar.
And the bad news is that while you can edit <dashboard>
views in the splunk UI, and drag and drop and use menus to edit visualization options, no such niceties exist for <form>
and you'll have to edit XML by hand.
http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step1CreateAForm
The main thing that <form>
can do is that it allows you to put text boxes and pulldowns in there. However in many cases <form>
itself becomes too limiting and people move on to the so-called Advanced XML.
Since the Simplified XML is really a sort-of macro-layer to the underlying 'advanced' system, you can convert simplified views to the corresponding advanced view.
http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml
And I should also add that if and when you make the leap to advanced XML, you should also make the leap to using the Sideview Utils modules in the advanced XML, because it makes the advanced XML much easier to read, deal with, and adds a lot of powerful features.
http://sideviewapps.com/apps/sideview-utils/
another answers post with good info: http://splunk-base.splunk.com/answers/29615/whats-the-best-way-to-convert-a-simple-xml-form-to-a-sid...
UPDATE. I wrote up a whole post to expand on Lowell's brief description of the process (the last link above). http://sideviewapps.com/654/so-youd-like-to-convert-a-simplified-xml-dashboard-or-form-to-sideview-u...
You can't do it with the <dashboard>
syntax. However there's another similar flavor of 'simplified XML' where the top tag is <form>
. The rules are a bit different inside the <form>
views, from what you're used to in <dashboard>
however they are pretty similar.
And the bad news is that while you can edit <dashboard>
views in the splunk UI, and drag and drop and use menus to edit visualization options, no such niceties exist for <form>
and you'll have to edit XML by hand.
http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step1CreateAForm
The main thing that <form>
can do is that it allows you to put text boxes and pulldowns in there. However in many cases <form>
itself becomes too limiting and people move on to the so-called Advanced XML.
Since the Simplified XML is really a sort-of macro-layer to the underlying 'advanced' system, you can convert simplified views to the corresponding advanced view.
http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml
And I should also add that if and when you make the leap to advanced XML, you should also make the leap to using the Sideview Utils modules in the advanced XML, because it makes the advanced XML much easier to read, deal with, and adds a lot of powerful features.
http://sideviewapps.com/apps/sideview-utils/
another answers post with good info: http://splunk-base.splunk.com/answers/29615/whats-the-best-way-to-convert-a-simple-xml-form-to-a-sid...
UPDATE. I wrote up a whole post to expand on Lowell's brief description of the process (the last link above). http://sideviewapps.com/654/so-youd-like-to-convert-a-simplified-xml-dashboard-or-form-to-sideview-u...
Please format the XML properly to be viewed on this site. Code sections should be indented with 4 spaces.
Any Suggestiong would help