but where in the xml does the above line go ?
wherever I enter it , it just errors out.
Sorry ,but am still new to splunk.
This is the first few lines of the code:
<form refresh="120">========================================>>>> ENTERED HERE ?
<input type="time" token="time_skip">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<panel>
<title>NETWORK 1</title>
<single>
<title>Most Recent CIRCUIT HIT ID</title>
<search>
<query>sourcetype=almn netdevice!=null ifname=* DCNETWORK | eval fields=split(ifname," ") | eval ifname=mvindex(fields,1) |table _time netdevice ifname almn_msg | dedup netdevice ifname| lookup circuit_info.csv local_device as netdevice, local_port as ifname | search circuit_id!=null | fields _time netdevice ifname almn_msg span carrier circuit_type cloud remote_device remote_port local_node l_96csm_port remote_node r_96csm_port circuit_id | top circuit_id</query>
<earliest>$time_skip.earliest$</earliest>
<latest>$time_skip.latest$</latest>
</search>
... View more