Dashboards & Visualizations

Why is my Simple XML not displaying the form I created?

Hindoo
Path Finder

Hello,

When i create a form, it displays normally, but when I return to review the form, there is nothing.
This is my code:

application

<input type="dropdown" token="sourcetype_tok">
  <label>Select a source type</label>
  <default>wineventlog:application</default>
  <choice value="wineventlog:application">wineventlog:application</choice>
  <choice value="wineventlog:system">wineventlog:system</choice>
</input>


<panel>
  <chart>
    <searchString>sourcetype="wineventlog:application"| timechart count by date_hour limit=10</searchString>
    <earliestTime>-30d@d</earliestTime>
    <latestTime>now</latestTime>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>


<panel>
  <chart>
    <searchString>sourcetype="wineventlog:setup"| timechart count by sourcetype limit=10</searchString>
    <earliestTime>-7d@h</earliestTime>
    <latestTime>now</latestTime>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>
0 Karma

Flynt
Splunk Employee
Splunk Employee

Hindoo, when you say :

But when I return to review the form, there is nothing.

Where are you trying to review the form? That doesn't appear to be the entirety of a form or dashboard as you're missing the "form" tags the "fieldset" tags for input, and "row" tags for each of your panels. Taking your code and adding the needed tags I was able to see the form with no issue. By the way, I see you have a dropdown passing a token but you don't use the token in any of your searches. Perhaps you were just debugging?

 <form>
  <fieldset>
    <input type="dropdown" token="sourcetype_tok">
       <label>Select a source type</label>
       <default>wineventlog:application</default>
       <choice value="wineventlog:application">wineventlog:application</choice>
       <choice value="wineventlog:system">wineventlog:system</choice>
     </input>
      </fieldset>
     <row>
     <panel>
       <chart>
         <searchString>sourcetype="wineventlog:application"| timechart count by date_hour limit=10</searchString>
         <earliestTime>-30d@d</earliestTime>
         <latestTime>now</latestTime>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
    </row>
     <row>
     <panel>
       <chart>
         <searchString>sourcetype="wineventlog:setup"| timechart count by sourcetype limit=10</searchString>
         <earliestTime>-7d@h</earliestTime>
         <latestTime>now</latestTime>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
    </row>
    </form>
0 Karma

Hindoo
Path Finder

the form displayed only for the first time !!!!!
whyyyyyyyy ??

0 Karma

Flynt
Splunk Employee
Splunk Employee

Have you changed the form? It's possible something is keeping it from rendering properly. Are you editing them manually or through the UI?

I suggest a thorough review of http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/CreateandeditdashboardsviatheUI

0 Karma

Hindoo
Path Finder

thanks , your code helped me
please , if i want to display it in real time , what are the change???

0 Karma

Flynt
Splunk Employee
Splunk Employee

I would suggest looking at http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/BuildandeditdashboardswithSimplifiedXML#Dashbo...

and you would change

<earliestTime></earliestTime>
<latestTime></latestTime>

Be warned that realtime dashboards come with performance considerations. Especially if you have many users looking at the dashboard. If you don't need up to the milisecond updates, I would use one of the other options that gets as close to the time period as you need.

If the answer and code worked for you, don't forget to accept the answer for others to benefit.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...