Dashboards & Visualizations

view error with </form> after </fieldset>

Chris_R_
Splunk Employee
Splunk Employee

I am creating a view with the following code. If I try to insert a < / form > after the </fieldset> it bails with an error. Any ideas why?

<?xml version='1.0' encoding='utf-8'?>
<form>

<label>2 Dashboard</label>
<fieldset>
<input type="text" token="searchHost">
<label>Enter host to search against (can be wildcard)</label>
<seed>fgw*</seed>
</input>
<input type="text" token="searchTerm">
<label>Enter keyword</label>
</input>

<input type="time" />
<default>Last 4 hours</default>
</fieldset>


<row>

<event>
<searchTemplate>host=$searchHost$ $searchTerm$ </searchTemplate>
<option name="showPager">true</option>
<option name="count">10</option>
</event>
</row>

<row>
<single>
<searchName>SV_countvulnerable Last 24f</searchName>
<title>Attacks against Vulnerable Hosts Detected Last 24 Hours</title>
<option name="classField">range</option>
<option name="linkFields">result</option>
<option name="linkSearch">search SFDC "Impact: Vulnerable"</option>
<option name="linkView">flashtimeline</option>
</single>
<table>
<searchName>SF_last_24h</searchName>
<title>IDS Alerts Last 24h</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>RT_suspicious</searchName>
<title>Top Suspicious Last Hour - Pie</title>
<option name="charting.chart">pie</option>
</chart>
<table>
<searchName>TopTenInternet_LastHour</searchName>
<title>Top 10 Internet-facing Source Ports Last Hour</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>pie_AV_infections left alone last 7 days</searchName>
<title>AV infections Last 7 days - not cleaned</title>
<option name="charting.chart">pie</option>

</chart>
<table>
<searchName>table_AV infections not cleaned Last 7 Days</searchName>
<title>AV infections: Last 7 days - not cleaned</title>
<option name="drilldown">row</option>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<table>
<searchName>vpnpoolusers_last_4hours</searchName>
<title>Vortex Users - Last 4 hours</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
<table>
<searchName>FW - All Top Talkers Last 60 minutes</searchName>
<title>All Firewalls - Top Talkers last 60 minutes</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<event>
<searchName>ASAFO1</searchName>
<title>Firewall Failover Events Last Hour</title>
</event>
</row>
</form>
0 Karma

sideview
SplunkTrust
SplunkTrust

What error are you seeing?

The closing </form> tag in your example actually comes all the way at the end of the simplified XML. In HTML you'd close your form after your last fieldset but in simplified XML you dont close the form tag until after all the <row> elements that contain charts and tables etc..

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...