You can find all of the elements in the Dashboards and Visualizations manual (https://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/PanelreferenceforSimplifiedXML#search). The <query> element is the search for Splunk to perform.  To learn about what goes here, try the Search Tutorial manual (https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchTutorial/WelcometotheSearchTutorial) or the free training available at https://www.splunk.com/en_us/training/course-catalog.html?sort=Newest&filters=filterGroup1FreeCourses ... View more