<form>
  <label>CIS - Input Monitor (v 1.0)</label>
  <description>CIS Analytics | Corporate Information Security</description>
  <fieldset submitButton="true" autoRun="true">
    <input type="time" token="mytime">
      <label>Select a time range for the master chart</label>
      <default>
        <earliest>-1h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="myspan" searchWhenChanged="true">
      <label>Select a Span</label>
      <choice value="1m">1 Min</choice>
      <choice value="5m">5 Mins</choice>
      <choice value="15m">15 Mins</choice>
      <choice value="30m">30 Mins</choice>
      <choice value="1h">1 Hr</choice>
      <choice value="3h">3 Hrs</choice>
      <choice value="6h">6 Hrs</choice>
      <choice value="12h">12 Hrs</choice>
      <choice value="24h">24 Hrs</choice>
      <default>5m</default>
      <initialValue>5m</initialValue>
    </input>
    <input type="multiselect" token="mysite" searchWhenChanged="true">
      <label>Indexer Site</label>
      <choice value="prd-ssplapp*">P PROD</choice>
      <choice value="drs-ssplapp*">P DR</choice>
      <choice value="prd-vsplapp*">V PROD</choice>
      <choice value="drs-vsplapp*">V DR</choice>
      <default>prd-ssplapp*</default>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <initialValue>prd-ssplapp*</initialValue>
      <valuePrefix>host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
    </input>
    <input type="checkbox" token="mymetric" searchWhenChanged="true">
      <label>Select your metric</label>
      <choice value="avg(eval(tcp_KBps)) as &quot;KB/s&quot;">KB/s</choice>
      <choice value="avg(tcp_eps) as &quot;Events/s&quot;">Events/s</choice>
      <default>"avg(tcp_eps) as ""Events/s""","avg(eval(tcp_KBps)) as ""KB/s"""</default>
      <initialValue>avg(tcp_eps) as "Events/s",avg(eval(tcp_KBps)) as "KB/s"</initialValue>
      <delimiter> </delimiter>
    </input>
    <input type="radio" token="myresult" searchWhenChanged="true">
      <label>How to view result</label>
      <choice value="by host">By Device</choice>
      <choice value="by destPort">By Port</choice>
      <default>by destPort</default>
      <initialValue>by destPort</initialValue>
    </input>
    <input type="dropdown" token="mylimit" searchWhenChanged="true">
      <label>Limit result to:</label>
      <choice value="10">10</choice>
      <choice value="50">50</choice>
      <choice value="100">100</choice>
      <choice value="500">500</choice>
      <choice value="0">Show Me Everything</choice>
      <default>10</default>
      <initialValue>10</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Data/Event to the indexers</title>
      <chart>
        <search>
          <query>index=_internal source=*metrics.log* $mysite$ destPort=9997 | timechart span=$myspan$ $mymetric$ $myresult$ useother=f limit=$mylimit$</query>
          <earliest>$mytime.earliest$</earliest>
          <latest>$mytime.latest$</latest>
        </search>
        <selection>
          <set token="selection.earliest">$start$</set>
          <set token="selection.latest">$end$</set>
        </selection>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">"KB/s: _internal","Events/s: 42400","Events/s: 42401","Events/s: 42402","Events/s: 514","Events/s: 8510","Events/s: 9997","Events/s: 6033","Events/s: 8080","Events/s: splunk-idx-1005","Events/s: splunk-idx-1006","Events/s: splunk-idx-1007","Events/s: splunk-idx-1008","Events/s: splunk-idx-1009","Events/s: splunk-idx-1011","Events/s: splunk-idx-1016","Events/s: splunk-idx-1020","Events/s: splunk-idx-1025","Events/s: splunk-idx-1030","Events/s: splunk-idx-1004","Events/s: splunk-idx-2002","Events/s: splunk-idx-2003","Events/s: splunk-idx-2007","Events/s: splunk-idx-2010","Events/s: splunk-idx-2019","Events/s: splunk-idx-2020","Events/s: splunk-idx-2021","Events/s: splunk-idx-2024","Events/s: splunk-idx-2029","Events/s: splunk-idx-2033","Events/s: splunk-idx-3003","Events/s: splunk-idx-3004","Events/s: splunk-idx-3005","Events/s: splunk-idx-3007","Events/s: splunk-idx-3010","Events/s: splunk-idx-3013","Events/s: splunk-idx-3015","Events/s: splunk-idx-3016","Events/s: splunk-idx-3026","Events/s: splunk-idx-3027"</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Data/Event to the indexers</title>
      <table>
        <search>
          <query>index=_internal source=*metrics.log* $mysite$ destPort=9997 | timechart span=$myspan$ $mymetric$ $myresult$ useother=f limit=$mylimit$</query>
          <earliest>$mytime.earliest$</earliest>
          <latest>$mytime.latest$</latest>
        </search>
        <selection>
          <set token="selection.earliest">$start$</set>
          <set token="selection.latest">$end$</set>
        </selection>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>