Set global and local defaults
Using defaults can save you time by only having to set a data source or visualization option in one place. All options available for data sources can be declared in this section. If you declare an option in the defaults section for ds.search, for example, and have not set a refresh in the stanza, the default will apply to all such stanzas, including base searches and their respective chain searches.
There are three ways to that you can set set the properties for your dashboard:
- You can set them in the
defaultssection of the dashboard definition at thegloballevel for all visualizations or all data sources and add individual exceptions.
- You can set them in the
defaultssection without using theglobaldesignation, but instead, by data source type or visualization type.
- You can set them at the visualization or data source component level, within the stanza, without using the
defaultssection. Local settings will always override any of the same settings set indefaults.
For a list of default configuration options, see Default configuration options. For setting token defaults, see Setting tokens on a visualization click.
Use global defaults
For example, the following code snippet from the defaults section uses the global field to set refresh and refreshType settings for all data sources. However, because the data source type ds.search is also listed with a different time setting for refresh, all data source stanzas of that type will override the global refresh rate setting and respect the 5 minute refresh rate. Since no refreshType option is set, the ds.search stanzas, along with all other data source types, will inherit the refreshType setting.
"defaults": {
"dataSources": {
"global": {
"options": {
"refresh": "1m",
"refreshType": "delay"
}
}
"ds.search": {
"options": {
"refresh": "5m"
}
},
"visualizations": {
"global": {
"showProgressBar": false,
"showLastUpdated": false
},
"splunk.bar": {
"showProgressBar": true
}
}
}
Set defaults by data source or visualization type
You can set defaults for data sources by data source type without using the global field. For example:
"defaults": {
"ds.search": {
"options": {
"refresh": "3s",
"queryParameters": {
"earliest": "-4h@m"
}
}
}
}
You can set these properties without using the defaults section
Settings at the component level will always be respected over any settings in the defaults section. If you are using saved searches of the type ds.savedSearch, the original schedule of the report will always override any default setting, although the report will run when you add it the first time, even if it isn't the scheduled time.
Dashboard definition example with data source defaults and overrides
The following example shows a simple case of two visualizations. One of the associated data sources has a refresh time set at the component level, which overrides the refresh time set in the defaults section. The other defaults to the default settings.
Source code
Expand the box to view the complete definition. You can copy/paste the code into your own instance to see the data at work.
{
"title": "Dashboard Defaults Example",
"description": "",
"inputs": {},
"defaults": {
"dataSources": {
"global": {
"options": {
"queryParameters": {
"earliest": "-4h@m"
},
"refresh": "3s"
}
}
}
},
"visualizations": {
"viz_SLVQrcIj": {
"dataSources": {
"primary": "ds_ynckpPQp_ds_PXwQLKU6"
},
"description": "from defaults",
"options": {},
"title": "refresh=\"3s\"",
"type": "splunk.singlevalue"
},
"viz_jNoJyUkt": {
"dataSources": {
"primary": "ds_PXwQLKU6"
},
"description": "from component",
"options": {},
"title": "refresh=\"10s\"",
"type": "splunk.singlevalue"
}
},
"dataSources": {
"ds_PXwQLKU6": {
"name": "Search_1",
"options": {
"query": "index=_internal \n| stats count",
"refresh": "10s"
},
"type": "ds.search"
},
"ds_ynckpPQp_ds_PXwQLKU6": {
"name": "Copy of Search_1",
"options": {
"query": "index=_internal \n| stats count"
},
"type": "ds.search"
}
},
"layout": {
"layoutDefinitions": {
"layout_1": {
"structure": [
{
"item": "viz_jNoJyUkt",
"position": {
"h": 150,
"w": 150,
"x": 490,
"y": 50
},
"type": "block"
},
{
"item": "viz_SLVQrcIj",
"position": {
"h": 150,
"w": 160,
"x": 680,
"y": 50
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
}
Dashboard definition example with visualization defaults and overrides
In the following example, there are various examples of how the defaults section and the global property can be used to override defaults. For example, if you don't define showProgressBar, the default behavior is that all visualizations will not show them. However, if you specify the property as true for a specific visualization type, those visualizations will show progress bars. If you specify the setting as true in the global section of the hierarchy, all visualizations will show a progress bar. All visualizations will show the latest refresh time because the property showLastUpdated is set to true, with no exceptions.
The same structure is true for the options set in the dataSources section of defaults.
The visualization properties are elements specific to Splunk, and are not considered setting options. You set them without identifying a field. Specifically, you set them at the same level as the other fields, such as options.
Source code
Expand the box to view the complete definition. You can copy/paste the code into your own instance to see the data at work.
{
"visualizations": {
"viz_LKLC6aUb": {
"type": "splunk.area",
"options": {
"backgroundColor": "white"
},
"dataSources": {
"primary": "ds_E4bbdtwS"
},
"title": "Has a progress bar due to area default",
"description": "Overrides global default"
},
"viz_tpRnLS1I": {
"type": "splunk.singlevalue",
"showProgressBar": true,
"options": {
"showSparkline": false,
"backgroundColor": "#ffffff"
},
"title": "Does have a progress bar",
"description": "Due to single viz override",
"dataSources": {
"primary": "ds_o7IqGHcO"
}
},
"viz_d9rHmb6e": {
"type": "splunk.singlevalue",
"showProgressBar": true,
"options": {
"backgroundColor": "#ffffff"
},
"title": "Does have a progress bar",
"description": "Due to single viz override",
"dataSources": {
"primary": "ds_5Bz2VyBy"
}
},
"viz_SpW3iWQQ": {
"type": "splunk.line",
"options": {
"backgroundColor": "white"
},
"dataSources": {
"primary": "ds_sJ1sIAyM_ds_E4bbdtwS"
},
"title": "Does not have a progress bar",
"description": "Due to global defaults"
},
"viz_72zdhYuK": {
"type": "splunk.area",
"options": {
"backgroundColor": "white"
},
"dataSources": {
"primary": "ds_WlKpQPzF_ds_E4bbdtwS"
},
"title": "Does not have a progress bar",
"description": "Viz setting overrides area viz default"
}
},
"dataSources": {
"ds_E4bbdtwS": {
"type": "ds.search",
"options": {
"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
},
"name": "timechart_search"
},
"ds_o7IqGHcO": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "0",
"latest": ""
},
"query": "index=_internal \n| stats count"
},
"name": "Search_1"
},
"ds_5Bz2VyBy": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "@mon",
"latest": "now"
},
"query": "index=_internal \n| stats count"
},
"name": "Search_2"
},
"ds_sJ1sIAyM_ds_E4bbdtwS": {
"type": "ds.search",
"options": {
"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
},
"name": "Copy of timechart_search"
},
"ds_WlKpQPzF_ds_E4bbdtwS": {
"type": "ds.search",
"options": {
"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
},
"name": "Copy of timechart_search"
}
},
"inputs": {},
"defaults": {
"visualizations": {
"global": {
"showProgressBar": false,
"showLastUpdated": true
},
"splunk.area": {
"showProgressBar": true
}
}
},
"description": "",
"title": "Defaults example",
"layout": {
"tabs": {
"items": [
{
"layoutId": "layout_1",
"label": "New tab"
}
]
},
"layoutDefinitions": {
"layout_1": {
"type": "absolute",
"options": {
"width": 2350,
"height": 1090,
"display": "auto-scale"
},
"structure": [
{
"item": "viz_LKLC6aUb",
"type": "block",
"position": {
"x": 20,
"y": 20,
"w": 1210,
"h": 370
}
},
{
"item": "viz_tpRnLS1I",
"type": "block",
"position": {
"x": 1250,
"y": 20,
"w": 510,
"h": 310
}
},
{
"item": "viz_d9rHmb6e",
"type": "block",
"position": {
"x": 1780,
"y": 20,
"w": 540,
"h": 310
}
},
{
"item": "viz_SpW3iWQQ",
"type": "block",
"position": {
"x": 1260,
"y": 370,
"w": 1100,
"h": 690
}
},
{
"item": "viz_72zdhYuK",
"type": "block",
"position": {
"x": -20,
"y": 410,
"w": 1250,
"h": 600
}
}
]
}
},
"options": {
"submitButton": true,
"showTitleAndDescription": true
}
}
}
In the defaults section of the dashboard definition you can see that only the area visualizations should show progress bars because the global setting for all visualizations, except area charts, is set to false.
"defaults": {
"visualizations": {
"global": {
"showProgressBar": false
},
"splunk.area": {
"showProgressBar": true
}
}
However, you'll notice that the single value visualizations do have progress bars. This is because the property was defined at the component level of the individual visualization stanzas.
| Scenario: Skyler conditionally shows and hides dashboard panels | Download and schedule email exports of dashboard content for sharing |
This documentation applies to the following versions of Splunk® Enterprise: 9.4.0
Download manual
Feedback submitted, thanks!