Have you ever made a terrific dashboard in Splunk and then thought…”Hmm, this is such a great dashboard, but I wish I could filter it for a subset of this data” or “hmmm….this dashboard should win an Academy Award, and now I’d like to exactly recreate it but for a different set of data”. Yes? Then you’re a great candidate for Splunk’s Simple XML forms.
There’s some great documentation on that topic here, but no documentation is so great that it can’t be improved with a cheat sheet. I’ve made one and it lives here. Enjoy and please email me (srussell@splunk.com) with praise, concerns, suggestions, and knock knock jokes.