Converting simple XML to advanced XML

Let's go back to one of the dashboards we created in Chapter 5, Simple XML Dashboards—errors_user_form.

We built this before our app, so it still lives in the Search app.

Just to refresh your memory, the simple XML code behind this dashboard looks like this:

<?xml version='1.0' encoding='utf-8'?> 
<form> 
<fieldset> 
<input type="text" token="user"> 
<label>User</label> 
</input> 
<input type="time" /> 
</fieldset> 
<label>Errors User Form</label> 
<row> 
<chart> 
<searchString> 
sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network 
</searchString> 
<title> 
Dashboard - Errors - errors by network timechart 
</title> 
<option name="charting.chart">line</option> 
</chart> 
</row> 
<row> 
<chart> 
<searchString> 
sourcetype="impl_splunk_gen" loglevel=error user="$user$" | bucket bins=10 req_time | stats count by req_time 
</searchString> 
<title> 
Error count by req_times 
</title> 
<option name="charting.chart">pie</option> 
</chart> 
<chart> 
<searchString> 
sourcetype="impl_splunk_gen" loglevel=error user="$user$" | stats count by logger 
</searchString> 
<title>Errors by logger</title> 
<option name="charting.chart">pie</option> 
</chart> 
</row> 
<row> 
<event> 
<searchString> 
sourcetype="impl_splunk_gen" loglevel=error user="$user$" 
</searchString> 
<title>Error events</title> 
<option name="count">10</option> 
<option name="displayRowNumbers">true</option> 
<option name="maxLines">10</option> 
<option name="segmentation">outer</option> 
<option name="softWrap">true</option> 
</event> 
</row> 
</form> 

In simple XML, the layout and logic flow are tied together. Before simple XML is rendered to the user, Splunk first dynamically converts it to advanced XML in memory. We can access advanced XML by appending ?showsource=advanced to any URL, as follows:

http://localhost:8000/en-US/app/is_app_one/errors?showsource=advanced

This produces a page (somewhat different from the earlier version of Splunk, when you used showsource=1) similar to this:

This is followed by a textbox containing raw XML, as shown here:

An abbreviated version of the advanced XML version of errors_user_form follows:

<view 
... template="dashboard.html"> 
<label>Errors User Form</label> 
<module name="AccountBar" layoutPanel="appHeader"/> 
<module name="AppBar" layoutPanel="navigationHeader"/> 
<module name="Message" layoutPanel="messaging"> 
...<module name="Message" layoutPanel="messaging"> 
...<module name="TitleBar" layoutPanel="viewHeader"> 
...<module name="ExtendedFieldSearch" layoutPanel="viewHeader"> 
<param name="replacementMap"> 
<param name="arg"> 
<param name="user"/> 
</param> 
</param> 
<param name="field">User</param> 
<param name="intention"> 
... <module name="TimeRangePicker"> 
<param name="searchWhenChanged">False</param> 
<module name="SubmitButton"> 
<param name="allowSoftSubmit">True</param> 
<param name="label">Search</param> 
<module 
name="HiddenSearch" 
layoutPanel="panel_row1_col1" 
group="Dashboard - Errors - errors by network timechart" 
autoRun="False"> 
<param name="search"> 
sourcetype="impl_splunk_gen" 
loglevel=error user="$user$" 
| timechart count as "Error count" by network 
</param> 
<param name="groupLabel"> 
Dashboard - Errors - errors by network timechart 
</param> 
<module name="ViewstateAdapter"> 
<param name="suppressionList"> 
<item>charting.chart</item> 
</param> 
<module name="HiddenFieldPicker"> 
<param name="strictMode">True</param> 
<module name="JobProgressIndicator"> 
<module name="EnablePreview"> 
<param name="enable">True</param> 
<param name="display">False</param> 
<module name="HiddenChartFormatter"> 
<param name="charting.chart">line</param> 
<module name="JSChart"> 
<param name="width">100%</param> 
<module name="Gimp"/> 
<module name="ConvertToDrilldownSearch"> 
<module name="ViewRedirector"> 
... </module> 
<module name="ViewRedirectorLink"> 
... </module> 
<module 
name="HiddenSearch" 
layoutPanel="panel_row2_col1" 
group="Error count by req_times" 
autoRun="False"> 
<param name="search"> 
sourcetype="impl_splunk_gen" loglevel=error 
user="$user$" 
| bucket bins=10 req_time | stats count by req_time 
</param> 
<param name="groupLabel">Error count by req_times</param> 
... </module> 
<module 
name="HiddenSearch" 
layoutPanel="panel_row2_col2" 
group="Errors by logger" 
autoRun="False"> 
<param name="search"> 
sourcetype="impl_splunk_gen" 
loglevel=error user="$user$" 
| stats count by logger 
</param> 
<param name="groupLabel">Errors by logger</param> 
... </module> 
<module 
name="HiddenSearch" 
layoutPanel="panel_row3_col1" 
group="Error events" 
autoRun="False"> 
<param name="search"> 
sourcetype="impl_splunk_gen" 
loglevel=error 
user="$user$" 
</param> 
<param name="groupLabel">Error events</param> 
<module name="ViewstateAdapter"> 
... <module name="HiddenFieldPicker"> 
... <module name="JobProgressIndicator"/> 
<module name="Paginator"> 
<param name="count">10</param> 
... <module name="EventsViewer"> 
... <module name="Gimp"/> 
... </module> 
... 
</view> 

This XML code is more verbose than we actually need, but luckily, it is easier to delete code than to create it.