Forms allow you to make a template that needs one or more pieces of information supplied to run. You can build these directly using raw XML, but I find it simpler to build a simple dashboard and then modify the XML accordingly. The other option is to copy an existing dashboard and modify it to meet your needs. We will touch on a simple use case in the following section.
First, let's think of a use case that we might be able to use with our previous example. How about a form that tells us about the forecast events for a particular year? Let's start with our previous search example:
sourcetype="*" Forecast | timechart count as "Forecast Events" by