Tag: Splunk Dashboard

Sample Code: <input type="text" token="Degree"> <label>Instance</label> <default>ENTER_THE_DEGREE</default> <change> <condition match="like(lower($value$),&quot;cs%&quot;)"> <set token="DegreeFullForm">Computer Science - upper($value$)</set> </condition> <condition match="like(lower($value$),&quot;it%&quot;)"> <set token="DegreeFullFormegree">Information Technology - upper($value$)</set> </condition> </change> </input> For input token Degree, ....

Use Drilldown Editor: Sample XML: <form> <label>Sample Explore</label> <search id="Event_transcript_search"> <query>PLEASE ENTER YOUR QUERY</query> <earliestTime>$earliest$</earliestTime> <latestTime>$latest$</latestTime> </search> <search id="Event_key_search"> <query> PLEASE ENTER YOUR QUERY </query> <earliestTime>$earliest$</earliestTime> <latestTime>$latest$</latestTime> </search> <fieldset submitButton="true" ....

This error is due to usage of < or > symbols. Do not use < or > symbols. Use &lt; and &gt; instead. Example: rex field=_raw "errorCode: (?<error_code>d+)" The above ....