Creating a form from a dashboard

First, let's think of a use case that we might be able to use with our previous example. How about a form that tells us about the forecast events for a particular year? Let's start with our previous search example:

sourcetype="*" Forecast | timechart count as "Forecast Events" by 
 date_month 

Since we have already created a dashboard from this query earlier in this chapter, let's look at the XML for our dashboard. As we did earlier, click on Source (on the dashboard editor). The XML for our dashboard looks like the following code. Notice the occurrence of two <panel> tags within our XML, indicating that there are two panels in our dashboard:

<dashboard> 
 <label>Forecast Events</label> 
 <description>This is my wonderful save as dashboard example.</description> 
 <row> 
  <panel> 
   <table> 
    <title>Forecast Events From Previous Year</title> 
    <search> 
     <query>sourcetype="*" Forecast | timechart count as "Forecast Events" by date_month</query> 
     <earliest>-1y@y</earliest> 
     <latest>@y</latest> 
    </search> 
   </table> 
  </panel> 
  <panel> 
   <chart> 
    <title>Prior Year Forecasting Events</title> 
    <search ref="Prior Year Forecasting Events"></search> 
    <option name="list.drilldown">full</option> 
    <option name="list.wrap">1</option> 
    <option name="maxLines">5</option> 
    <option name="raw.drilldown">full</option> 
    <option name="rowNumbers">0</option> 
    <option name="table.drilldown">all</option> 
    <option name="table.wrap">1</option> 
    <option name="type">list</option> 
    <fields>["host","source","sourcetype"]</fields> 
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> 
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> 
    <option name="charting.axisTitleX.visibility">visible</option> 
    <option name="charting.axisTitleY.visibility">visible</option> 
    <option name="charting.axisTitleY2.visibility">visible</option> 
    <option name="charting.axisX.scale">linear</option> 
    <option name="charting.axisY.scale">linear</option> 
    <option name="charting.axisY2.enabled">false</option> 
    <option name="charting.axisY2.scale">inherit</option> 
    <option name="charting.chart">line</option> 
    <option name="charting.chart.bubbleMaximumSize">50</option> 
    <option name="charting.chart.bubbleMinimumSize">10</option> 
    <option name="charting.chart.bubbleSizeBy">area</option> 
    <option name="charting.chart.nullValueMode">gaps</option> 
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option> 
    <option name="charting.chart.stackMode">default</option> 
    <option name="charting.chart.style">shiny</option> 
    <option name="charting.drilldown">all</option> 
    <option name="charting.layout.splitSeries">0</option> 
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> 
    <option name="charting.legend.placement">right</option> 
   </chart> 
  </panel> 
 </row> 
</dashboard> 

That's pretty simple. To convert our dashboard into a form, we have to do the following things.

First, we change <dashboard> to <form> within our XML. Don't forget the closing tag </dashboard> to </form>. Next, we create a <fieldset> tag with any form elements.

It can be something like this:

<form> 
<label>Chapter 5 Build a Form 1</label> 
<fieldset> 
<input type="text" token="myyear"> 
<label>MyYear</label> 
</input> 
</fieldset> 

Now we add the appropriate variable in <query> to reflect the form values:

<query>sourcetype="*" Forecast date_year=$myyear$ | timechart 
 count as "Forecast Events" by date_month</query> 

When we're through, our XML looks like this:

<form> 
 <label>Forecast Events</label> 
 <description>This is my wonderful save as dashboard example.</description> 
 <label>Chapter 5 Build a Form 1</label> 
<fieldset> 
<input type="text" token="myyear"> 
<label>MyYear</label> 
</input> 
</fieldset> 
 <row> 
  <panel> 
   <table> 
    <title>Forecast Events From Previous Yeaar</title> 
    <search> 
     <query>sourcetype="*" Forecast date_year=$myyear$ | timechart count as "Forecast Events" by date_month</query> 
     <earliest>-1y@y</earliest> 
     <latest>@y</latest> 
    </search> 
   </table> 
  </panel> 
  <panel> 
   <chart> 
    <title>Prior Year Forecasting Events</title> 
    <search ref="Prior Year Forecasting Events"></search> 
    <option name="list.drilldown">full</option> 
    <option name="list.wrap">1</option> 
    <option name="maxLines">5</option> 
    <option name="raw.drilldown">full</option> 
    <option name="rowNumbers">0</option> 
    <option name="table.drilldown">all</option> 
    <option name="table.wrap">1</option> 
    <option name="type">list</option> 
    <fields>["host","source","sourcetype"]</fields> 
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> 
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> 
    <option name="charting.axisTitleX.visibility">visible</option> 
    <option name="charting.axisTitleY.visibility">visible</option> 
    <option name="charting.axisTitleY2.visibility">visible</option> 
    <option name="charting.axisX.scale">linear</option> 
    <option name="charting.axisY.scale">linear</option> 
    <option name="charting.axisY2.enabled">false</option> 
    <option name="charting.axisY2.scale">inherit</option> 
    <option name="charting.chart">line</option> 
    <option name="charting.chart.bubbleMaximumSize">50</option> 
    <option name="charting.chart.bubbleMinimumSize">10</option> 
    <option name="charting.chart.bubbleSizeBy">area</option> 
    <option name="charting.chart.nullValueMode">gaps</option> 
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option> 
    <option name="charting.chart.stackMode">default</option> 
    <option name="charting.chart.style">shiny</option> 
    <option name="charting.drilldown">all</option> 
    <option name="charting.layout.splitSeries">0</option> 
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> 
    <option name="charting.legend.placement">right</option> 
   </chart> 
  </panel> 
 </row> 
</form> 

Let's click on Save and then search for Forecast Events that occurred in a particular year. Now, looking at our example dashboard, we notice our input field MyYear and a Submit button at the top of the panel along with a Search is waiting for input... message:

We now have a useful form for displaying the forecast events for a particular year.