Let's go back to
one of the dashboards we created in Chapter 4, Simple XML Dashboards,
errors_user_form. We built this before our app, so it still lives in the Search app. In my instance, this URL is
Just to refresh, the simple XML behind this dashboard looks like:
<?xml version='1.0' encoding='utf-8'?> <form> <fieldset> <input type="text" token="user"> <label>User</label> </input> <input type="time" /> </fieldset> <label>Errors User Form</label> <row> <chart> <searchString> sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network </searchString> <title> Dashboard - Errors - errors by network timechart ...