Splunk® Enterprise

Splunk Dashboard Studio

Default configuration options

Set properties in the dataSource or visualizations stanzas under global or specify individual visualization types or data source types.

option or property type default description
refresh (data sources only) string n/a Specify the refresh interval with a time expression. For example, "5s" for five seconds or "1m" for one minute. See refreshType and refresh example.
refreshType (data sources only) (delay | interval) delay Indicate the starting time for a search to refresh. Use delay to start the countdown to refresh when the search is done. Use interval to countdown when the search is dispatched. See refreshType and refresh example.
queryParameters.earliest (data sources only) string n/a Specify the earliest time to search for events. Choose from year (y), month (m), week (w), day (d), minute (m), second (s), or 0 for all time. For example, if you want to run a search that runs for all time, see The queryParameters example. Defaults with "earliest": "$global_time.earliest$". Classic Simple XML dashboards that convert to Dashboard Studio must reset their defaults.
queryParameters.latest (data sources only) string n/a Specify the latest time to search for events. Choose from year (y), month (m), week (w), day (d), minute (m), second (s), or 0 for all time. For example, if you want to run a search that runs for all time, see The queryParameters example. Defaults with "latest": "$global_time.latest$". Classic Simple XML dashboards that convert to Dashboard Studio must reset their defaults.
showProgressBar (visualizations only) boolean false Specify whether to show a loading progress bar for a visualization. You can set the progress bar at the component level at the same level as options. These settings are not options but properties. You set the properties at the same level as the options field.
showLastUpdated (visualizations only) boolean false Specify whether to show the last time a visualization was updated. This time is shown on the bottom of a visualization in a tag in both Edit mode and View mode. These settings are not options but properties. You set the properties at the same level as the options field.

Adding a progress bar to a small visualization might make the visualization too small to show data. If this occurs, increase the visualization's size until you can see your data.

It is important to note that if you have defined an option in a data source stanza, it will override the same option set in defaults for that stanza only.

Don't specify default intervals of time that are too short. Any interval less than one minute might not give the search jobs enough time to run, or may have a heavy performance impact on your dashboard. You can specify a string with the interval, such as "1m" for one minute. If you specify an integer without a time unit, the default unit is seconds.

Last modified on 17 August, 2023
Dynamic options syntax formatting functions   Input configuration options

This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters