Dashboards & Visualizations

view error with </form> after </fieldset>

Chris_R_
Splunk Employee
Splunk Employee

I am creating a view with the following code. If I try to insert a < / form > after the </fieldset> it bails with an error. Any ideas why?

<?xml version='1.0' encoding='utf-8'?>
<form>

<label>2 Dashboard</label>
<fieldset>
<input type="text" token="searchHost">
<label>Enter host to search against (can be wildcard)</label>
<seed>fgw*</seed>
</input>
<input type="text" token="searchTerm">
<label>Enter keyword</label>
</input>

<input type="time" />
<default>Last 4 hours</default>
</fieldset>


<row>

<event>
<searchTemplate>host=$searchHost$ $searchTerm$ </searchTemplate>
<option name="showPager">true</option>
<option name="count">10</option>
</event>
</row>

<row>
<single>
<searchName>SV_countvulnerable Last 24f</searchName>
<title>Attacks against Vulnerable Hosts Detected Last 24 Hours</title>
<option name="classField">range</option>
<option name="linkFields">result</option>
<option name="linkSearch">search SFDC "Impact: Vulnerable"</option>
<option name="linkView">flashtimeline</option>
</single>
<table>
<searchName>SF_last_24h</searchName>
<title>IDS Alerts Last 24h</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>RT_suspicious</searchName>
<title>Top Suspicious Last Hour - Pie</title>
<option name="charting.chart">pie</option>
</chart>
<table>
<searchName>TopTenInternet_LastHour</searchName>
<title>Top 10 Internet-facing Source Ports Last Hour</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>pie_AV_infections left alone last 7 days</searchName>
<title>AV infections Last 7 days - not cleaned</title>
<option name="charting.chart">pie</option>

</chart>
<table>
<searchName>table_AV infections not cleaned Last 7 Days</searchName>
<title>AV infections: Last 7 days - not cleaned</title>
<option name="drilldown">row</option>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<table>
<searchName>vpnpoolusers_last_4hours</searchName>
<title>Vortex Users - Last 4 hours</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
<table>
<searchName>FW - All Top Talkers Last 60 minutes</searchName>
<title>All Firewalls - Top Talkers last 60 minutes</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<event>
<searchName>ASAFO1</searchName>
<title>Firewall Failover Events Last Hour</title>
</event>
</row>
</form>
0 Karma

sideview
SplunkTrust
SplunkTrust

What error are you seeing?

The closing </form> tag in your example actually comes all the way at the end of the simplified XML. In HTML you'd close your form after your last fieldset but in simplified XML you dont close the form tag until after all the <row> elements that contain charts and tables etc..

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...