How to display the log events in an organised form using Simple XML

[akarivaratharaj]

Hi Team,

We have recently upgraded the Splunk to version 8.0 . So the dashboards and reports whichever created in Advanced XML is not working so re-creating it in Simple XML. Earlier we were using a view called Flashtimeline, which will show the normal events in a very organised and user understandable way. This view was created in Advanced XML. Below is a sample log event, which is displayed in the view called flashtimeline (This displayed when we just give "index=xx sourcetype=yy host=zz").

Host:	xxx	Service:	DATABASE
Has Details:	N	Is Sample:	N
Process Name:	yyy
Request Id:	zzz
Request:	{call sp_name('*')}
Start Timestamp:	2020-09-07 04:29:56.986	End Timestamp:	2020-09-07 04:29:57.242
 
Timing Details (Total Exec Time=256 ms)
Name	Time since beginning (ms)	Execution Time(ms)	% of Total Time
BEGIN	0	0	0
preExecution	0	0	0
prepareStatement	0	0	0
setParameters	0	0	0
executeQuery	0	251	98
handleExecution	251	5	1
END	256	0	0

 
This is a very neat, organised and easily understandable format of an event. 
Here is the actual display of the same event, when we try to search in the Search app with the same query "index=xx sourcetype=yy host=zz"

"2020-09-07 04:29:00.995","10.241.140.193","DATABASE","sp_name","2020-09-07 04:29:01.197","xxx","1","202","","BEGIN","1599452940995","preExecution","1599452940995","prepareStatement","1599452940995","setParameters","1599452940995","executeQuery","1599452940995","handleExecution","1599452940998","END","1599452941197","-","-1","-","-1","-","-1","yyy","-","zzz","N"," {CALL sp_name(?, ?, ?, ?)}","N"

 
I am aware the Flashtimeline was deprecated during the Splunk 6.x version itself and it was replaced with Search app.
But I would like to display the events in a neat and organised way (as like the first sample event) with Simple XML code.

Could anyone please help me on getting this as soon as possible.

[akarivaratharaj]

Could someone help me on this please?