Implementing Splunk - Second Edition

Building forms

Forms allow you to make a template that needs one or more pieces of information supplied to run. You can build these directly using raw XML, but I find it simpler to build a simple dashboard and then modify the XML accordingly. The other option is to copy an existing dashboard and modify it to meet your needs. We will touch on a simple use case in the following section.

Creating a form from a dashboard

First, let's think of a use case that we might be able to use with our previous example. How about a form that tells us about the forecast events for a particular year? Let's start with our previous search example:

sourcetype="*" Forecast | timechart count as "Forecast Events" by date_month

Since we have already created a dashboard from ...