I am having trouble getting my form search to bring back anything. The xml is accepted by splunk but the search won't bring back anything. It always says 0. here is the xml code...
<label>My Search Engine</label>
<searchTemplate>"$SearchHere$" | head 250</searchTemplate>
Enter a sourcetype in the field below and this view will pull back the most recent 100 events from the metrics log concerning that sourcetype.
<input type="text" token="username">
<label>Enter a user name</label>
<default>Last 24 Hours</default>
Another approach could be to build a few dashboards using splunk's dashboard building wizard and review the XML it generates for you. This is not a bad way to get started. If you haven't walked though the forms how intro in the docs, that's another good place to start: