Set global and local defaults
Using defaults can save you time by only having to set a data source or visualization option in one place. All options available for data sources can be declared in this section. If you declare an option in the defaults section for ds.search
, for example, and have not set a refresh in the stanza, the default will apply to all such stanzas, including base searches and their respective chain searches.
There are three ways to that you can set set the properties for your dashboard:
- You can set them in the
defaults
section of the dashboard definition at theglobal
level for all visualizations or all data sources and add individual exceptions.
- You can set them in the
defaults
section without using theglobal
designation, but instead, by data source type or visualization type.
- You can set them at the visualization or data source component level, within the stanza, without using the
defaults
section. Local settings will always override any of the same settings set indefaults
.
For a list of default configuration options, see Default configuration options. For setting token defaults, see Setting tokens on a visualization click.
Use global defaults
For example, the following code snippet from the defaults
section uses the global
field to set refresh
and refreshType
settings for all data sources. However, because the data source type ds.search
is also listed with a different time setting for refresh
, all data source stanzas of that type will override the global refresh rate setting and respect the 5 minute refresh rate. Since no refreshType
option is set, the ds.search
stanzas, along with all other data source types, will inherit the refreshType
setting.
"defaults": { "dataSources": { "global": { "options": { "refresh": "1m", "refreshType": "delay" } } "ds.search": { "options": { "refresh": "5m" } }, "visualizations": { "global": { "showProgressBar": false, "showLastUpdated": false }, "splunk.bar": { "showProgressBar": true } } }
Set defaults by data source or visualization type
You can set defaults for data sources by data source type without using the global
field. For example:
"defaults": { "ds.search": { "options": { "refresh": "3s", "queryParameters": { "earliest": "-4h@m" } } } }
You can set these properties without using the defaults section
Settings at the component level will always be respected over any settings in the defaults
section. If you are using saved searches of the type ds.savedSearch
, the original schedule of the report will always override any default setting, although the report will run when you add it the first time, even if it isn't the scheduled time.
Dashboard definition example with data source defaults and overrides
The following example shows a simple case of two visualizations. One of the associated data sources has a refresh time set at the component level, which overrides the refresh time set in the defaults
section. The other defaults to the default settings.
Source code
Expand the box to view the complete definition. You can copy/paste the code into your own instance to see the data at work.
{ "visualizations": { "viz_jNoJyUkt": { "type": "splunk.singlevalue", "options": {}, "dataSources": { "primary": "ds_PXwQLKU6" }, "title": "refresh=\"10s\"", "description": "from component" }, "viz_SLVQrcIj": { "type": "splunk.singlevalue", "options": {}, "dataSources": { "primary": "ds_ynckpPQp_ds_PXwQLKU6" }, "title": "refresh=\"3s\"", "description": "from defaults" } }, "dataSources": { "ds_PXwQLKU6": { "type": "ds.search", "options": { "query": "index=_internal \n| stats count", "refresh": "10s" }, "name": "Search_1" }, "ds_ynckpPQp_ds_PXwQLKU6": { "type": "ds.search", "options": { "query": "index=_internal \n| stats count" }, "name": "Copy of Search_1" } }, "inputs": {}, "layout": { "type": "absolute", "options": {}, "structure": [ { "item": "viz_jNoJyUkt", "type": "block", "position": { "x": 490, "y": 50, "w": 150, "h": 150 } }, { "item": "viz_SLVQrcIj", "type": "block", "position": { "x": 680, "y": 50, "w": 160, "h": 150 } } ] }, "defaults": { "dataSources":{ "global": { "options": { "refresh": "3s", "queryParameters": { "earliest": "-4h@m" } } } } }, "description": "", "title": "Dashboard Defaults Example" }
Dashboard definition example with visualization defaults and overrides
In the following example, there are various examples of how the defaults
section and the global
property can be used to override defaults. For example, if you don't define showProgressBar
, the default behavior is that all visualizations will not show them. However, if you specify the property as true
for a specific visualization type, those visualizations will show progress bars. If you specify the setting as true
in the global
section of the hierarchy, all visualizations will show a progress bar. All visualizations will show the latest refresh time because the property showLastUpdated
is set to true, with no exceptions.
The same structure is true for the options set in the dataSources
section of defaults
.
The visualization properties are elements specific to Splunk, and are not considered setting options. You set them without identifying a field. Specifically, you set them at the same level as the other fields, such as options
.
Source code
Expand the box to view the complete definition. You can copy/paste the code into your own instance to see the data at work.
{ "visualizations": { "viz_LKLC6aUb": { "type": "splunk.area", "options": { "backgroundColor": "white" }, "dataSources": { "primary": "ds_E4bbdtwS" }, "title": "Has a progress bar due to area default", "description": "Overrides global default" }, "viz_tpRnLS1I": { "type": "splunk.singlevalue", "showProgressBar": true, "options": { "showSparkline": false, "backgroundColor": "#ffffff" }, "title": "Does have a progress bar", "description": "Due to single viz override", "dataSources": { "primary": "ds_o7IqGHcO" } }, "viz_d9rHmb6e": { "type": "splunk.singlevalue", "showProgressBar": true, "options": { "backgroundColor": "#ffffff" }, "title": "Does have a progress bar", "description": "Due to single viz override", "dataSources": { "primary": "ds_5Bz2VyBy" } }, "viz_SpW3iWQQ": { "type": "splunk.line", "options": { "backgroundColor": "white" }, "dataSources": { "primary": "ds_sJ1sIAyM_ds_E4bbdtwS" }, "title": "Does not have a progress bar", "description": "Due to global defaults" }, "viz_72zdhYuK": { "type": "splunk.area", "options": { "backgroundColor": "white" }, "dataSources": { "primary": "ds_WlKpQPzF_ds_E4bbdtwS" }, "title": "Does not have a progress bar", "description": "Viz setting overrides area viz default" } }, "dataSources": { "ds_E4bbdtwS": { "type": "ds.search", "options": { "query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status" }, "name": "timechart_search" }, "ds_o7IqGHcO": { "type": "ds.search", "options": { "queryParameters": { "earliest": "0", "latest": "" }, "query": "index=_internal \n| stats count" }, "name": "Search_1" }, "ds_5Bz2VyBy": { "type": "ds.search", "options": { "queryParameters": { "earliest": "@mon", "latest": "now" }, "query": "index=_internal \n| stats count" }, "name": "Search_2" }, "ds_sJ1sIAyM_ds_E4bbdtwS": { "type": "ds.search", "options": { "query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status" }, "name": "Copy of timechart_search" }, "ds_WlKpQPzF_ds_E4bbdtwS": { "type": "ds.search", "options": { "query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status" }, "name": "Copy of timechart_search" } }, "inputs": {}, "layout": { "type": "absolute", "options": { "width": 2350, "height": 1090, "submitButton": true, "showTitleAndDescription": true, "display": "auto-scale" }, "structure": [ { "item": "viz_LKLC6aUb", "type": "block", "position": { "x": 20, "y": 20, "w": 1210, "h": 370 } }, { "item": "viz_tpRnLS1I", "type": "block", "position": { "x": 1250, "y": 20, "w": 510, "h": 310 } }, { "item": "viz_d9rHmb6e", "type": "block", "position": { "x": 1780, "y": 20, "w": 540, "h": 310 } }, { "item": "viz_SpW3iWQQ", "type": "block", "position": { "x": 1260, "y": 370, "w": 1100, "h": 690 } }, { "item": "viz_72zdhYuK", "type": "block", "position": { "x": -20, "y": 410, "w": 1250, "h": 600 } } ] }, "defaults": { "visualizations": { "global": { "showProgressBar": false, "showLastUpdated": true }, "splunk.area": { "showProgressBar": true } } }, "description": "", "title": "Defaults example" }
In the defaults
section of the dashboard definition you can see that only the area visualizations should show progress bars because the global setting for all visualizations, except area charts, is set to false
.
"defaults": { "visualizations": { "global": { "showProgressBar": false }, "splunk.area": { "showProgressBar": true } }
However, you'll notice that the single value visualizations do have progress bars. This is because the property was defined at the component level of the individual visualization stanzas.
Scenario: Skyler conditionally shows and hides dashboard panels | Download and schedule email exports of dashboard content for sharing |
This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.2.0, 9.2.1, 9.2.2, 9.3.0
Feedback submitted, thanks!