Splunk® IT Service Intelligence

Service Insights Manual

Splunk IT Service Intelligence (ITSI) version 4.11.x reached its End of Life on December 6, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see Before you upgrade IT Service Intelligence.
This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. For documentation on the most recent version, go to the latest release.

Define default properties for glass tables in ITSI

The defaults section of a glass table in IT Service Intelligence (ITSI) defines default properties for various glass table elements. There are two ways to set default properties:

  • In the defaults section of the glass table definition at a global level for all visualizations or all data sources.
  • In the defaults section without using the global designation, but instead by data source or visualization type.

Set global defaults

The following code snippet from the defaults section uses the global field to set refresh and refreshType settings for all data sources. However, because the data source type ds.search is also listed with a different time setting for refresh, all data source stanzas of that type override the global refresh rate setting and respect the 5-minute refresh rate. Because no refreshType option is set, the ds.search stanzas, along with all other data source types, inherits the refreshType setting. 

  "defaults": {
    "dataSources": {
      "global": {
        "options": {
          "refresh": "1m",
          "refreshType": "delay"
        }
      },
      "ds.search": {
        "options": {
          "refresh": "5m"
        }
      }
    },
    "visualizations": {
      "global": {
        "showProgressBar": false,
        "showLastUpdated": false
      },
      "viz.bar": {
        "showProgressBar": true
      }
    }
  }

Set defaults by data source or visualization type

You can set defaults for data sources by data source type without using the global field. For example: 

"defaults": {
	"ds.search": {
		"options": {
			"refresh": "3s",
			"queryParameters": {
				"earliest": "-4h@m"
			}
		}
	}
}

Example with data source defaults and overrides

The following example shows a simple case of two visualizations. One of the associated data sources has a refresh time set at the component level, which overrides the refresh time set in the defaults section. The other defaults to the default settings.

Source code

Expand the box to view the complete definition. You can paste the code into your own instance to see the data at work. 


{
"visualizations": {
	"viz_jNoJyUkt": {
		"type": "viz.singlevalue",
		"options": {},
		"dataSources": {
			"primary": "ds_PXwQLKU6"
		},
		"title": "refresh=\"10s\"",
		"description": "from component"
	},
	"viz_SLVQrcIj": {
		"type": "viz.singlevalue",
		"options": {},
		"dataSources": {
			"primary": "ds_ynckpPQp_ds_PXwQLKU6"
		},
		"title": "refresh=\"3s\"",
		"description": "from defaults"
	}
},
"dataSources": {
	"ds_PXwQLKU6": {
		"type": "ds.search",
		"options": {
			"query": "index=_internal \n|  stats count",
			"refresh": "10s"
		},
		"name": "Search_1"
	},
	"ds_ynckpPQp_ds_PXwQLKU6": {
		"type": "ds.search",
		"options": {
			"query": "index=_internal \n|  stats count"
		},
		"name": "Copy of Search_1"
	}
},
"inputs": {},
"layout": {
	"type": "absolute",
	"options": {},
	"structure": [
		{
			"item": "viz_jNoJyUkt",
			"type": "block",
			"position": {
				"x": 490,
				"y": 50,
				"w": 150,
				"h": 150
			}
		},
		{
			"item": "viz_SLVQrcIj",
			"type": "block",
			"position": {
				"x": 680,
				"y": 50,
				"w": 160,
				"h": 150
			}
		}
	]
},
"defaults": {
        "dataSources":{
	     "global": {
		 "options": {
			"refresh": "3s",
			"queryParameters": {
				"earliest": "-4h@m"
			}
		}
	}
   }
},
	"description": "",
	"title": "Glass Table Defaults Demo"
}


Example with visualization defaults and overrides

The following example shows different ways to use the defaults section and the global property to override defaults. For example, if you don't define showProgressBar, all visualizations show them. However, if you specify the property as false for a specific visualization type, those visualizations don't show progress bars. If you specify the setting as false in the global section of the hierarchy, no visualizations show a progress bar. No visualizations show the latest refresh time because the property showLastUpdated is set to false.

The same structure is true for the options set in the dataSources section of defaults.

Source code

Expand the box to view the complete definition. You can paste the code into your own instance to see the data at work. 

{
"visualizations": {
	"viz_LKLC6aUb": {
		"type": "viz.area",
		"options": {
			"backgroundColor": "#FFFFFF"
		},
		"dataSources": {
			"primary": "ds_E4bbdtwS"
		},
		"title": "Has a progress bar due to area default",
		"description": "Overrides global default"
	},
	"viz_tpRnLS1I": {
		"type": "viz.singlevalue",
		"showProgressBar": true,
		"options": {
			"showSparkline": false,
			"backgroundColor": "#FFFFFF"
		},
		"title": "Does have a progress bar",
		"description": "Due to single viz override",
		"dataSources": {
			"primary": "ds_o7IqGHcO"
		},
		"encoding": {}
	},
	"viz_d9rHmb6e": {
		"type": "viz.singlevalue",
		"showProgressBar": true,
		"options": {
			"backgroundColor": "#FFFFFF"
		},
		"title": "Does have a progress bar",
		"description": "Due to single viz override",
		"dataSources": {
			"primary": "ds_5Bz2VyBy"
		}
	},
	"viz_SpW3iWQQ": {
		"type": "viz.line",
		"options": {
			"backgroundColor": "#FFFFFF"
		},
		"dataSources": {
			"primary": "ds_sJ1sIAyM_ds_E4bbdtwS"
		},
		"title": "Does not have a progress bar",
		"description": "Due to global defaults"
	},
	"viz_72zdhYuK": {
		"type": "viz.area",
		"options": {
			"backgroundColor": "#FFFFFF"
		},
		"dataSources": {
			"primary": "ds_WlKpQPzF_ds_E4bbdtwS"
		},
		"title": "Does not have a progress bar",
		"description": "Viz setting overrides area viz default"
	}
},
"dataSources": {
	"ds_E4bbdtwS": {
		"type": "ds.search",
		"options": {
			"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
		},
		"name": "timechart_search"
	},
	"ds_o7IqGHcO": {
		"type": "ds.search",
		"options": {
			"queryParameters": {
				"earliest": "0",
				"latest": ""
			},
			"query": "index=_internal \n| stats count"
		},
		"name": "Search_1"
	},
	"ds_5Bz2VyBy": {
		"type": "ds.search",
		"options": {
			"queryParameters": {
				"earliest": "@mon",
				"latest": "now"
			},
			"query": "index=_internal \n|  stats count"
		},
		"name": "Search_2"
	},
	"ds_sJ1sIAyM_ds_E4bbdtwS": {
		"type": "ds.search",
		"options": {
			"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
		},
		"name": "Copy of timechart_search"
	},
	"ds_WlKpQPzF_ds_E4bbdtwS": {
		"type": "ds.search",
		"options": {
			"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
		},
		"name": "Copy of timechart_search"
	}
},
"inputs": {},
"layout": {
	"type": "absolute",
	"options": {
		"width": 2350,
		"height": 1090,
		"submitButton": true,
		"showTitleAndDescription": true,
		"display": "auto-scale"
	},
	"structure": [
		{
			"item": "viz_LKLC6aUb",
			"type": "block",
			"position": {
				"x": 20,
				"y": 20,
				"w": 1210,
				"h": 370
			}
		},
		{
			"item": "viz_tpRnLS1I",
			"type": "block",
			"position": {
				"x": 1250,
				"y": 20,
				"w": 510,
				"h": 310
			}
		},
		{
			"item": "viz_d9rHmb6e",
			"type": "block",
			"position": {
				"x": 1780,
				"y": 20,
				"w": 540,
				"h": 310
			}
		},
		{
			"item": "viz_SpW3iWQQ",
			"type": "block",
			"position": {
				"x": 1260,
				"y": 370,
				"w": 1100,
				"h": 690
			}
		},
		{
			"item": "viz_72zdhYuK",
			"type": "block",
			"position": {
				"x": -20,
				"y": 410,
				"w": 1250,
				"h": 600
			}
		}
	]
},
"defaults": {
	"visualizations": {
		"global": {
			"showProgressBar": false,
                         "showLastUpdated": false
		},
		"viz.area": {
			"showProgressBar": true
		}
	}
},
	"description": "",
	"title": "Defaults example"
}


Only the area visualizations show progress bars because the global setting for all visualizations, except area charts, is set to false. 

"defaults": {
		"visualizations": {
			"global": {
				"showProgressBar": false
			},
			"viz.area": {
				"showProgressBar": true
			}
		}


However, the single value visualizations do have progress bars because the property was defined at the component level of the individual visualization stanzas.

Sample options for the defaults section

Set properties in the dataSource or visualizations stanzas under either global or specify individual visualization types or data source types. Following the JSON format, each setting must be enclosed in quotes unless it is a boolean value or a number. Options other than the last one set must end in a comma.

option type default description
refresh string N/A Specify the refresh interval with a time expression. For example, "5s" for five seconds or "1m" for one minute.
refreshType (delay | interval) delay Indicate the starting time for a search to refresh. Use "delay" to start the countdown to refresh when the search is done. Use "interval" to count down when the search is dispatched.
queryParameters.earliest string N/A Specify the earliest time to search for events. Choose from year (y), month (m), week (w), day (d), minute, (m), or second (s), or 0 for all time.
queryParameters.latest string N/A Specify the latest time to search for events. Choose from year (y), month (m), week (w), day (d), minute, (m), or second (s), or 0 for all time.
queryParameters.timezone string User's timezone Set the timezone for the search parameters to run in.
cancelJobsOnFocusLoss boolean false When set in the defaults section this option lets you determine whether searches stop running when a user navigates away from a glass table. The default is false, meaning that when a user leaves the glass table to look at another page, the searches continue to run. If set to true, the searches stop upon leaving the glass table screen and the user must refresh the screen to restart the searches.
showProgressBar (visualizations only) boolean true Specify whether to show a loading progress bar for a visualization. Can be set at the component level at the same level as options.
showLastUpdated (visualizations only) boolean true Specify whether to show the last time a visualization was updated. This is shown on the bottom of a visualization in a tag in both Edit and View mode.
Last modified on 23 January, 2023
Add inputs and tokens to glass tables in ITSI   Source options reference for the glass table editor in ITSI

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters