Dashboards & Visualizations
Highlighted

Why is my Simple XML not displaying the form I created?

Path Finder

Hello,

When i create a form, it displays normally, but when I return to review the form, there is nothing.
This is my code:

application

<input type="dropdown" token="sourcetype_tok">
  <label>Select a source type</label>
  <default>wineventlog:application</default>
  <choice value="wineventlog:application">wineventlog:application</choice>
  <choice value="wineventlog:system">wineventlog:system</choice>
</input>


<panel>
  <chart>
    <searchString>sourcetype="wineventlog:application"| timechart count by date_hour limit=10</searchString>
    <earliestTime>-30d@d</earliestTime>
    <latestTime>now</latestTime>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>


<panel>
  <chart>
    <searchString>sourcetype="wineventlog:setup"| timechart count by sourcetype limit=10</searchString>
    <earliestTime>-7d@h</earliestTime>
    <latestTime>now</latestTime>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>
0 Karma
Highlighted

Re: Why is my Simple XML not displaying the form I created?

Splunk Employee
Splunk Employee

Hindoo, when you say :

But when I return to review the form, there is nothing.

Where are you trying to review the form? That doesn't appear to be the entirety of a form or dashboard as you're missing the "form" tags the "fieldset" tags for input, and "row" tags for each of your panels. Taking your code and adding the needed tags I was able to see the form with no issue. By the way, I see you have a dropdown passing a token but you don't use the token in any of your searches. Perhaps you were just debugging?

 <form>
  <fieldset>
    <input type="dropdown" token="sourcetype_tok">
       <label>Select a source type</label>
       <default>wineventlog:application</default>
       <choice value="wineventlog:application">wineventlog:application</choice>
       <choice value="wineventlog:system">wineventlog:system</choice>
     </input>
      </fieldset>
     <row>
     <panel>
       <chart>
         <searchString>sourcetype="wineventlog:application"| timechart count by date_hour limit=10</searchString>
         <earliestTime>-30d@d</earliestTime>
         <latestTime>now</latestTime>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
    </row>
     <row>
     <panel>
       <chart>
         <searchString>sourcetype="wineventlog:setup"| timechart count by sourcetype limit=10</searchString>
         <earliestTime>-7d@h</earliestTime>
         <latestTime>now</latestTime>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
    </row>
    </form>
0 Karma
Highlighted

Re: Why is my Simple XML not displaying the form I created?

Path Finder

thanks , your code helped me
please , if i want to display it in real time , what are the change???

0 Karma
Highlighted

Re: Why is my Simple XML not displaying the form I created?

Splunk Employee
Splunk Employee

I would suggest looking at http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/BuildandeditdashboardswithSimplifiedXML#Dashbo...

and you would change

<earliestTime></earliestTime>
<latestTime></latestTime>

Be warned that realtime dashboards come with performance considerations. Especially if you have many users looking at the dashboard. If you don't need up to the milisecond updates, I would use one of the other options that gets as close to the time period as you need.

If the answer and code worked for you, don't forget to accept the answer for others to benefit.

0 Karma
Highlighted

Re: Why is my Simple XML not displaying the form I created?

Path Finder

the form displayed only for the first time !!!!!
whyyyyyyyy ??

0 Karma
Highlighted

Re: Why is my Simple XML not displaying the form I created?

Splunk Employee
Splunk Employee

Have you changed the form? It's possible something is keeping it from rendering properly. Are you editing them manually or through the UI?

I suggest a thorough review of http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/CreateandeditdashboardsviatheUI

0 Karma