view XML

noun

Every page in Splunk's UI is built out of XML. These pages are called views and the XML that they are built out of is called "view XML." There are two types of view XML: advanced and simplified. The simplified XML is built on top of the advanced XML and only offers a subset of the functionality of the advanced XML. When you use Splunk Web methods to create dashboards and panels (such as the Add to Dashboard workflow), Splunk creates them with the simple XML syntax.

In general, it's a good idea to start building dashboards and other views using simplified XML. If you find that you'd like to move on to the advanced XML, you can always translate your simplified XML views to the advanced XML syntax and continue building it.

For more information

In the Developer Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time