Dashboards & Visualizations

view error with </form> after </fieldset>

Chris_R_
Splunk Employee
Splunk Employee

I am creating a view with the following code. If I try to insert a < / form > after the </fieldset> it bails with an error. Any ideas why?

<?xml version='1.0' encoding='utf-8'?>
<form>

<label>2 Dashboard</label>
<fieldset>
<input type="text" token="searchHost">
<label>Enter host to search against (can be wildcard)</label>
<seed>fgw*</seed>
</input>
<input type="text" token="searchTerm">
<label>Enter keyword</label>
</input>

<input type="time" />
<default>Last 4 hours</default>
</fieldset>


<row>

<event>
<searchTemplate>host=$searchHost$ $searchTerm$ </searchTemplate>
<option name="showPager">true</option>
<option name="count">10</option>
</event>
</row>

<row>
<single>
<searchName>SV_countvulnerable Last 24f</searchName>
<title>Attacks against Vulnerable Hosts Detected Last 24 Hours</title>
<option name="classField">range</option>
<option name="linkFields">result</option>
<option name="linkSearch">search SFDC "Impact: Vulnerable"</option>
<option name="linkView">flashtimeline</option>
</single>
<table>
<searchName>SF_last_24h</searchName>
<title>IDS Alerts Last 24h</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>RT_suspicious</searchName>
<title>Top Suspicious Last Hour - Pie</title>
<option name="charting.chart">pie</option>
</chart>
<table>
<searchName>TopTenInternet_LastHour</searchName>
<title>Top 10 Internet-facing Source Ports Last Hour</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<chart>
<searchName>pie_AV_infections left alone last 7 days</searchName>
<title>AV infections Last 7 days - not cleaned</title>
<option name="charting.chart">pie</option>

</chart>
<table>
<searchName>table_AV infections not cleaned Last 7 Days</searchName>
<title>AV infections: Last 7 days - not cleaned</title>
<option name="drilldown">row</option>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<table>
<searchName>vpnpoolusers_last_4hours</searchName>
<title>Vortex Users - Last 4 hours</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
<table>
<searchName>FW - All Top Talkers Last 60 minutes</searchName>
<title>All Firewalls - Top Talkers last 60 minutes</title>
<option name="showPager">true</option>
<option name="count">25</option>
</table>
</row>
<row>
<event>
<searchName>ASAFO1</searchName>
<title>Firewall Failover Events Last Hour</title>
</event>
</row>
</form>
0 Karma

sideview
SplunkTrust
SplunkTrust

What error are you seeing?

The closing </form> tag in your example actually comes all the way at the end of the simplified XML. In HTML you'd close your form after your last fieldset but in simplified XML you dont close the form tag until after all the <row> elements that contain charts and tables etc..

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...