An example splunk dashboard XML

<dashboard>
  <label>My label</label>
  <description>A description</description>

  <row>
    <panel>
      <title>Datacentre 1</title>
      <table>
        <search>

          <query>
            (host=jupiter ORhost=neptune)
            sourcetype=apache* source=*check_endpoints_info.log HTTP_STATUS_CODE: |
            rex field=_raw "TIMESTAMP:(?&lt;TIMESTAMP&gt;.+)\s+APP" |
            rex field=_raw "APP:(?&lt;SERVICE&gt;.+)\s+PORT" |
            rex field=_raw "CONTEXT ROOT:(?&lt;CONTEXT_ROOT&gt;.+)\s+GET" |
            rex field=_raw "\s+GET:\s+(?&lt;URI&gt;.+)\s+HTTP.+Host" |
            rex field=_raw "\s+HTTP_STATUS_CODE:\s+(?&lt;HTTP_STATUS&gt;\d+).+" |
            rex field=_raw "PORT:(?&lt;PORT&gt;.+)CONTEXT ROOT" |
            stats max(TIMESTAMP) as TIMESTAMP by host,SERVICE,URI,HTTP_STATUS |
            sort host
          </query>
         
          <earliest>-210s@s</earliest>
          <latest>now</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>
       
        </search>

        <option name="count">18</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
       
        <format type="color" field="HTTP_STATUS">
          <colorPalette type="map">{"200":#65A637,"404":#D93F3C,"500":#D93F3C,"503":#D93F3C}</colorPalette>
        </format>

      </table>
    </panel>

    <panel>
      <title>Datacentre 2</title>
      <table>
        <search>

          <query>
            (host=mars OR host=venus)
            sourcetype=apache* source=*check_endpoints_info.log HTTP_STATUS_CODE: |
            rex field=_raw "TIMESTAMP:(?&lt;TIMESTAMP&gt;.+)\s+APP" |
            rex field=_raw "APP:(?&lt;SERVICE&gt;.+)\s+PORT" |
            rex field=_raw "CONTEXT ROOT:(?&lt;CONTEXT_ROOT&gt;.+)\s+GET" |
            rex field=_raw "\s+GET:\s+(?&lt;URI&gt;.+)\s+HTTP.+Host" |
            rex field=_raw "\s+HTTP_STATUS_CODE:\s+(?&lt;HTTP_STATUS&gt;\d+).+" |
            rex field=_raw "PORT:(?&lt;PORT&gt;.+)CONTEXT ROOT" |
            stats max(TIMESTAMP) as TIMESTAMP by host,SERVICE,URI,HTTP_STATUS |
            sort host
          </query>

          <earliest>-4m@m</earliest>
          <latest>now</latest>
          <refresh>1m</refresh>
          <refreshType>delay</refreshType>

        </search>

        <option name="count">18</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="HTTP_STATUS">
          <colorPalette type="map">{"200":#65A637,"404":#D93F3C,"500":#D93F3C,"503":#D93F3C}</colorPalette>
        </format>

      </table>
    </panel>
  </row>
</dashboard>