Form searches in Splunk do not need to be limited to displaying events and table-driven data. Rich visualizations can also be linked to forms and be updated when the forms are submitted.
This recipe will show you how you can extend a form to include charts and other visualizations that can be driven by the form created to show visitor traffic and location data.
To step through this recipe, you will need a running Splunk Enterprise server, with the sample data loaded from Chapter 1, Play Time – Getting Data In, and should have completed the earlier recipes in this chapter. You should also be familiar with navigating the Splunk user interface.
Follow these steps to add a web page activity chart and link it to a form:
Log in to your Splunk server.
Select the default Operational Intelligence application.
Select the Dashboards menu item.
Select the Visitor Monitoring dashboard.
Click on the Edit button and then on Edit Panels.
Click...