Dashboards & Visualizations

view error with </form> after </fieldset>

Chris_R_
Splunk Employee
Splunk Employee

I am creating a view with the following code. If I try to insert a < / form > after the </fieldset> it bails with an error. Any ideas why?

<?xml version='1.0' encoding='utf-8'?>
<form>

<label>2 Dashboard</label>
<fieldset>
<input type="text" token="searchHost">
<label>Enter host to search against (can be wildcard)</label>
<seed>fgw*</seed>
</input>
<input type="text" token="searchTerm">
<label>Enter keyword</label>
</input>

<input type="time" />
<default>Last 4 hours</default>
</fieldset>


<row>

<event>
<searchTemplate>host=$searchHost$ $searchTerm$ </searchTemplate>
<option name="showPager">true</option>
<option name="count">10</option>
</event>
</row>

<row>
<single>
<searchName>SV_countvulnerable Last 24f</searchName>
<title>Attacks against Vulnerable Hosts Detected Last 24 Hours</title>
<option name="classField">range</option>
<option name="linkFields">result</option>
<option name="linkSearch">search SFDC "Impact: Vulnerable"</option>
<option name="linkView">flashtimeline</option>
</single>
<table>
<searchName>SF_last_24h</searchName>
<title>IDS Alerts Last 24h</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>RT_suspicious</searchName>
<title>Top Suspicious Last Hour - Pie</title>
<option name="charting.chart">pie</option>
</chart>
<table>
<searchName>TopTenInternet_LastHour</searchName>
<title>Top 10 Internet-facing Source Ports Last Hour</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>pie_AV_infections left alone last 7 days</searchName>
<title>AV infections Last 7 days - not cleaned</title>
<option name="charting.chart">pie</option>

</chart>
<table>
<searchName>table_AV infections not cleaned Last 7 Days</searchName>
<title>AV infections: Last 7 days - not cleaned</title>
<option name="drilldown">row</option>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<table>
<searchName>vpnpoolusers_last_4hours</searchName>
<title>Vortex Users - Last 4 hours</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
<table>
<searchName>FW - All Top Talkers Last 60 minutes</searchName>
<title>All Firewalls - Top Talkers last 60 minutes</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<event>
<searchName>ASAFO1</searchName>
<title>Firewall Failover Events Last Hour</title>
</event>
</row>
</form>
0 Karma

sideview
SplunkTrust
SplunkTrust

What error are you seeing?

The closing </form> tag in your example actually comes all the way at the end of the simplified XML. In HTML you'd close your form after your last fieldset but in simplified XML you dont close the form tag until after all the <row> elements that contain charts and tables etc..

Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...