We have almost the same setup in our network. Here is the settings we finally ended up with that seem to work pretty well. We still get errors from time to time (fact of life with UDP) but it's a lot better then before. [root@syslog151 etc]# uname -a Linux syslog151.xxx.voxeo.net 2.6.18-164.el5 #1 SMP Thu Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux [root@syslog151 etc]# [root@syslog151nti etc]# rpm -q -a |grep syslog syslog-ng-2.0.9-1.el5 [root@syslog151nti etc]# # sysctl.conf # Change the socket read buffer sizes net.core.rmem_max = 16777216 net.core.rmem_default = 8388608 syslog-ng.conf: options { flush_lines (1000); stats_freq (300); time_reap (30); log_fifo_size (500000); time_reopen (2); use_dns (yes); dns_cache (yes); dns_cache_size(300); dns_cache_expire(3600); dns_cache_expire_failed(3600); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); chain_hostnames (no); perm(0444); dir_perm(0555); group("wheel"); dir_group("wheel"); }; ... View more

Found the trick, you need to do with the savedsearch=XXX syntax: <form> <label>HTTP Stats</label> <fieldset autoRun="true"> <input type="time"> <default>Last 24 hours</default> </input> </fieldset> <row> <chart> <title>HTTP Fetch Count</title> <searchTemplate>savedsearch="HTTP - All VoiceXML Fetches"| timechart count </searchTemplate> <option name="charting.chart">area</option> <option name="charting.AreaChart.stackMode">stacked</option> </chart> </row> </form> ... View more

I am not sure about via the CLI or Web UI but you can edit the viewstates.conf if needed, however the mapping between the saved search and the vsid can be a bit cryptic at times the first time you see it. Lets assume you have a savedsearch.conf entry that looks like this: [Media - Report - RTP Errors - Last 4 hours] dispatch.earliest_time = -4h@h dispatch.latest_time = now displayview = report_builder_display request.ui_dispatch_view = report_builder_display search = rtpstat | extract rtpstat | where rtpErrRXTooMuchProcessed > 0 OR rtpErrNoData > 0 OR rtpErrRXUnterminatedDTMFs > 0 OR rtpErrRXSpamPackets >0 OR rtpErrRXProatvDroppedPkts > 0 OR rtpErrTXSendErrors > 0 | timechart sum(rtpErrRXSpamPackets) sum(rtpErrRXTooMuchProcessed) sum(rtpErrRXUnterminatedDTMFs) sum(rtpErrRXVoicePktDroppedDurDTMF) sum(rtpErrTXSendErrors) vsid = *:gd1t63rz What you can do is look up that vsid (gd1t63rz) in viewstates.conf to find the formatter for that view: [*:gd1t63rz] ChartTitleFormatter_0_6_0.default = RTP Error Counts ChartTypeFormatter_0_4_0.default = line Count_0_3_0.default = 50 DataOverlay_0_5_0.dataOverlayMode = none DataOverlay_0_5_0.default = heatmap FlashChart_0_4_1.height = 504px LegendFormatter_0_10_0.default = right LineMarkerFormatter_0_7_0.default = false NullValueFormatter_0_9_0.default = gaps SplitModeFormatter_0_8_0.default = false StackModeFormatter_0_7_0.default = default XAxisTitleFormatter_0_6_1.default = time In this entry the line you would want to edit is the "ChartTypeFormatter_0_4_0.default = line" entry to have the type that you are looking for. ... View more

Ok, did some digging and it looks like the rendering / parsing of simple XML modules is done in $SPLUNK_HOME/lib/python2.6/site-packages/splunk/appserver/mrsparkle/lib/view/* Specifically form.py and dashboard.py have a toObject() method that builds the object tree of the final resulting module. For example here is the start of the module for form searches: def toObject(self): # build the standard dashboard view preamble output = { 'isVisible': self.isVisible, 'label': self.label, 'onunloadCancelJobs': self.onunloadCancelJobs, 'autoCancelInterval': self.autoCancelInterval, 'stylesheet': self.stylesheet, 'template': self.template, 'objectMode': self.objectMode, 'modules': [ { 'className': 'AccountBar', 'layoutPanel': 'appHeader' }, { 'className': 'AppBar', 'layoutPanel': 'navigationHeader' }, This then is rendered into the internal XML later on. Sadly I don't see any supported way to edit this from inside an application so any edits here should be done at your own risk (or really not done at all). ... View more