tags:

views:

14

answers:

0

i cant seem to get splunk to coorporate with me, ive formed the xml but can't seem to get any search results, here is the xml code

 <form>
 <label>My Search Engine</label>
 <searchTemplate>"$SearchHere$" | head 250</searchTemplate>
 <earliestTime>-30d</earliestTime>
 <latestTime>-0d</latestTime>
 <html>
 Enter a sourcetype in the field below and this view will pull back the most recent 100      events from the metrics log concerning that sourcetype.
 </html>
 <fieldset>
 <input type="text" token="username">
 <label>Enter a user name</label>
 <default>Last 24 Hours</default>
 </input>
 </fieldset>
 <row>
 <chart>
 <title>User logins</title>
 <option name="charting.chart">pie</option>
 </chart>
 <event>
 <title>Matching events</title>
 <fields>_raw</fields>
 <option name="count">250</option>
 </event>
 </row>
 </form>