Dashboards & Visualizations

Why is my Simple XML not displaying the form I created?

Hindoo
Path Finder

Hello,

When i create a form, it displays normally, but when I return to review the form, there is nothing.
This is my code:

application

<input type="dropdown" token="sourcetype_tok">
  <label>Select a source type</label>
  <default>wineventlog:application</default>
  <choice value="wineventlog:application">wineventlog:application</choice>
  <choice value="wineventlog:system">wineventlog:system</choice>
</input>


<panel>
  <chart>
    <searchString>sourcetype="wineventlog:application"| timechart count by date_hour limit=10</searchString>
    <earliestTime>-30d@d</earliestTime>
    <latestTime>now</latestTime>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>


<panel>
  <chart>
    <searchString>sourcetype="wineventlog:setup"| timechart count by sourcetype limit=10</searchString>
    <earliestTime>-7d@h</earliestTime>
    <latestTime>now</latestTime>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.nullValueMode">gaps</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
  </chart>
</panel>
0 Karma

Flynt
Splunk Employee
Splunk Employee

Hindoo, when you say :

But when I return to review the form, there is nothing.

Where are you trying to review the form? That doesn't appear to be the entirety of a form or dashboard as you're missing the "form" tags the "fieldset" tags for input, and "row" tags for each of your panels. Taking your code and adding the needed tags I was able to see the form with no issue. By the way, I see you have a dropdown passing a token but you don't use the token in any of your searches. Perhaps you were just debugging?

 <form>
  <fieldset>
    <input type="dropdown" token="sourcetype_tok">
       <label>Select a source type</label>
       <default>wineventlog:application</default>
       <choice value="wineventlog:application">wineventlog:application</choice>
       <choice value="wineventlog:system">wineventlog:system</choice>
     </input>
      </fieldset>
     <row>
     <panel>
       <chart>
         <searchString>sourcetype="wineventlog:application"| timechart count by date_hour limit=10</searchString>
         <earliestTime>-30d@d</earliestTime>
         <latestTime>now</latestTime>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
    </row>
     <row>
     <panel>
       <chart>
         <searchString>sourcetype="wineventlog:setup"| timechart count by sourcetype limit=10</searchString>
         <earliestTime>-7d@h</earliestTime>
         <latestTime>now</latestTime>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">line</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">default</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
       </chart>
     </panel>
    </row>
    </form>
0 Karma

Hindoo
Path Finder

the form displayed only for the first time !!!!!
whyyyyyyyy ??

0 Karma

Flynt
Splunk Employee
Splunk Employee

Have you changed the form? It's possible something is keeping it from rendering properly. Are you editing them manually or through the UI?

I suggest a thorough review of http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/CreateandeditdashboardsviatheUI

0 Karma

Hindoo
Path Finder

thanks , your code helped me
please , if i want to display it in real time , what are the change???

0 Karma

Flynt
Splunk Employee
Splunk Employee

I would suggest looking at http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/BuildandeditdashboardswithSimplifiedXML#Dashbo...

and you would change

<earliestTime></earliestTime>
<latestTime></latestTime>

Be warned that realtime dashboards come with performance considerations. Especially if you have many users looking at the dashboard. If you don't need up to the milisecond updates, I would use one of the other options that gets as close to the time period as you need.

If the answer and code worked for you, don't forget to accept the answer for others to benefit.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...