Dashboards & Visualizations
Highlighted

view error with </form> after </fieldset>

Splunk Employee
Splunk Employee

I am creating a view with the following code. If I try to insert a < / form > after the </fieldset> it bails with an error. Any ideas why?

<?xml version='1.0' encoding='utf-8'?>
<form>

<label>2 Dashboard</label>
<fieldset>
<input type="text" token="searchHost">
<label>Enter host to search against (can be wildcard)</label>
<seed>fgw*</seed>
</input>
<input type="text" token="searchTerm">
<label>Enter keyword</label>
</input>

<input type="time" />
<default>Last 4 hours</default>
</fieldset>


<row>

<event>
<searchTemplate>host=$searchHost$ $searchTerm$ </searchTemplate>
<option name="showPager">true</option>
<option name="count">10</option>
</event>
</row>

<row>
<single>
<searchName>SV_countvulnerable Last 24f</searchName>
<title>Attacks against Vulnerable Hosts Detected Last 24 Hours</title>
<option name="classField">range</option>
<option name="linkFields">result</option>
<option name="linkSearch">search SFDC "Impact: Vulnerable"</option>
<option name="linkView">flashtimeline</option>
</single>
<table>
<searchName>SF_last_24h</searchName>
<title>IDS Alerts Last 24h</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>RT_suspicious</searchName>
<title>Top Suspicious Last Hour - Pie</title>
<option name="charting.chart">pie</option>
</chart>
<table>
<searchName>TopTenInternet_LastHour</searchName>
<title>Top 10 Internet-facing Source Ports Last Hour</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>pie_AV_infections left alone last 7 days</searchName>
<title>AV infections Last 7 days - not cleaned</title>
<option name="charting.chart">pie</option>

</chart>
<table>
<searchName>table_AV infections not cleaned Last 7 Days</searchName>
<title>AV infections: Last 7 days - not cleaned</title>
<option name="drilldown">row</option>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<table>
<searchName>vpnpoolusers_last_4hours</searchName>
<title>Vortex Users - Last 4 hours</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
<table>
<searchName>FW - All Top Talkers Last 60 minutes</searchName>
<title>All Firewalls - Top Talkers last 60 minutes</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<event>
<searchName>ASAFO1</searchName>
<title>Firewall Failover Events Last Hour</title>
</event>
</row>
</form>
0 Karma
Highlighted

Re: view error with </form> after </fieldset>

SplunkTrust
SplunkTrust

What error are you seeing?

The closing </form> tag in your example actually comes all the way at the end of the simplified XML. In HTML you'd close your form after your last fieldset but in simplified XML you dont close the form tag until after all the <row> elements that contain charts and tables etc..