Overview of simple XML
Splunk's simple XML syntax allows you to create basic dashboards. The following sections of this chapter walk you through the steps of developing a dashboard using simple XML. Here are some of the basics of simple XML:
<dashboard>is the base tag of a dashboard. XML files implementing dashboards are wrapped in these tags.
- Use the
refreshattribute to set how frequently, in seconds, to refresh the dashboard. For example,
<dashboard refresh="30">sets the refresh rate to 30 seconds.
<form>is the base tag of a dashboard that accepts user input to define the search displayed in the dashboard.
- For dashboards that accept user input, do not use the
<dashboard>tag. Instead, use the top-level
<form>tag. See Build and edit forms with simple XML for details on building forms.
<label>is a child tag of
<dashboard>. It specifies the display name of the dashboard.
- Dashboards present panels in rows, designated by the
<row>tag. Each row can contain up to three panels.
- Each panel is a visualization of data returned by the panel's search. Here are common visualizations for panels:
<event>: Displays a list of events.
<table>: Displays data in a table.
<chart>: Displays returned data in a chart.
<option>tags define the type and layout of the chart.
- Child tags to a panel include:
<searchName>: specifies a saved search.
<searchString>: specifies an inline search specific to that panel.
<title>: Display name for the panel.
<latestTime>: specifies the time range for the search.
<option>tags to a panel that define the type and properties of the panel visualization. For example:
<option name="charting.chart">pie</option>specifies a pie chart for the visualization type.
<option name="count">12</option>specifies to display 12 rows in a table.
See the Splunk Panel Reference for details on specifying visualizations for panels.
Panels available for dashboards
With simple XML, you can specify the type of visualization to display in a panel. The visualizations available include the following:
- Single button
The panel reference lists all visualizations plus includes examples of the underlying Simplified XML.
Most of the documentation in this manual describes creating and editing dashboards using simple XML. Simple XML sits on top of Splunk's advanced XML implementation. Complex dashboards and forms might need to leverage functionality only available from advanced XML.
You can always convert simple XML to advanced XML. However, you cannot later go back to simple XML. Splunk recommends that you start advanced projects in simple XML, and then convert them later to advanced XML to add the more complex features.
About Advanced XML provides details on editing Advanced XML.
To convert simple XML to advanced XML, in Splunk Web use the showsource URI. For example:
Special characters in XML files
Some characters have special meaning in an XML file and cannot be used literally. You can wrap the text within CDATA tags as illustrated below. The XML parser does not process text within CDATA tags.
<![CDATA[ <code>"Text within a CDATA tag"</code> ]]>
Or you can escape these characters using HTML entities:
Generate dashboard PDFs
Build and edit dashboards with simple XML
This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18