Forms allow you to make a template that needs one or more pieces of information supplied to run. You can build these directly using raw XML, but I find it simpler to build a simple dashboard and then modify the XML accordingly. The other option is to copy an existing dashboard and modify it to meet your needs. We will touch on a simple use case in the following section.
First, let's think of a use case that we might be able to use with our previous example. How about a form that tells us about the forecast events for a particular year? Let's start with our previous search example:
sourcetype="*" Forecast | timechart count as "Forecast Events" by date_month
Since we have already created a dashboard from this query (in the section Using wizards to build dashboards), let's look at the XML for our dashboard. As we did earlier, click on Edit Source (on the dashboard editor). The XML for our dashboard looks like the following code. Notice the occurrence...