Set global and local defaults

Using defaults can save you time by only having to set a data source or visualization option in one place. All options available for data sources can be declared in this section. If you declare an option in the defaults section for ds.search, for example, and have not set a refresh in the stanza, the default will apply to all such stanzas, including base searches and their respective chain searches.

There are three ways to that you can set set the properties listed in Options you can use in the defaults section for your dashboard.

• You can set them in the defaults section of the dashboard definition at the global level for all visualizations or all data sources and add individual exceptions.

• You can set them in the defaults section without using the global designation, but instead, by data source type or visualization type.

• You can set them at the visualization or data source component level, within the stanza, without using the defaults section. Local settings will always override any of the same settings set in defaults.

For setting token defaults, see Setting tokens on a visualization click.

Use global defaults

For example, the following code snippet from the defaults section uses the global field to set refresh and refreshType settings for all data sources. However, because the data source type ds.search is also listed with a different time setting for refresh, all data source stanzas of that type will override the global refresh rate setting and respect the 5 minute refresh rate. Since no refreshType option is set, the ds.search stanzas, along with all other data source types, will inherit the refreshType setting.

"defaults": {
    "dataSources": {
        "global": {
            "options": {
                "refresh": "1m",
                "refreshType": "delay"
            }
        }
        "ds.search": {
            "options": {
                "refresh": "5m"
            }
        }
    },
     "visualizations": {
        "global": {
            "showProgressBar": false,
            "showLastUpdated": false
        },
        "splunk.bar": {
            "showProgressBar": true
        }
    }
}

Set defaults by data source or visualization type

You can set defaults for data sources by data source type without using the global field. For example:

"defaults": {
	"ds.search": {
		"options": {
			"refresh": "3s",
			"queryParameters": {
				"earliest": "-4h@m"
			}
		}
	}
}

You can set these properties without using the defaults section

Settings at the component level will always be respected over any settings in the defaults section. If you are using saved searches of the type ds.savedSearch, the original schedule of the report will always override any default setting, although the report will run when you add it the first time, even if it isn't the scheduled time.

Dashboard definition example with data source defaults and overrides

The following example shows a simple case of two visualizations. One of the associated data sources has a refresh time set at the component level, which overrides the refresh time set in the defaults section. The other defaults to the default settings.

Source code

Expand the box to view the complete definition. You can copy/paste the code into your own instance to see the data at work.

{
"visualizations": {
	"viz_jNoJyUkt": {
		"type": "splunk.singlevalue",
		"options": {},
		"dataSources": {
			"primary": "ds_PXwQLKU6"
		},
		"title": "refresh=\"10s\"",
		"description": "from component"
	},
	"viz_SLVQrcIj": {
		"type": "splunk.singlevalue",
		"options": {},
		"dataSources": {
			"primary": "ds_ynckpPQp_ds_PXwQLKU6"
		},
		"title": "refresh=\"3s\"",
		"description": "from defaults"
	}
},
"dataSources": {
	"ds_PXwQLKU6": {
		"type": "ds.search",
		"options": {
			"query": "index=_internal \n|  stats count",
			"refresh": "10s"
		},
		"name": "Search_1"
	},
	"ds_ynckpPQp_ds_PXwQLKU6": {
		"type": "ds.search",
		"options": {
			"query": "index=_internal \n|  stats count"
		},
		"name": "Copy of Search_1"
	}
},
"inputs": {},
"layout": {
	"type": "absolute",
	"options": {},
	"structure": [
		{
			"item": "viz_jNoJyUkt",
			"type": "block",
			"position": {
				"x": 490,
				"y": 50,
				"w": 150,
				"h": 150
			}
		},
		{
			"item": "viz_SLVQrcIj",
			"type": "block",
			"position": {
				"x": 680,
				"y": 50,
				"w": 160,
				"h": 150
			}
		}
	]
},
"defaults": {
        "dataSources":{
	      "global": {
		   "options": {
			 "refresh": "3s",
			 "queryParameters": {
				 "earliest": "-4h@m"
			}
		}
	 }
   }
},
	"description": "",
	"title": "Dashboard Defaults Example"
}

Dashboard definition example with visualization defaults and overrides

In the following example, there are various examples of how the defaults section and the global property can be used to override defaults. For example, if you don't define showProgressBar, the default behavior is that all visualizations will not show them. However, if you specify the property as true for a specific visualization type, those visualizations will show progress bars. If you specify the setting as true in the global section of the hierarchy, all visualizations will show a progress bar. All visualizations will show the latest refresh time because the property showLastUpdated is set to true, with no exceptions.

The same structure is true for the options set in the dataSources section of defaults.

The visualization properties are elements specific to Splunk, and are not considered setting options. You set them without identifying a field. Specifically, you set them at the same level as the other fields, such as options.

Source code

Expand the box to view the complete definition. You can copy/paste the code into your own instance to see the data at work.

{
"visualizations": {
	"viz_LKLC6aUb": {
		"type": "splunk.area",
		"options": {
			"backgroundColor": "white"
		},
		"dataSources": {
			"primary": "ds_E4bbdtwS"
		},
		"title": "Has a progress bar due to area default",
		"description": "Overrides global default"
	},
	"viz_tpRnLS1I": {
		"type": "splunk.singlevalue",
		"showProgressBar": true,
		"options": {
			"showSparkline": false,
			"backgroundColor": "#ffffff"
		},
		"title": "Does have a progress bar",
		"description": "Due to single viz override",
		"dataSources": {
			"primary": "ds_o7IqGHcO"
		}
	},
	"viz_d9rHmb6e": {
		"type": "splunk.singlevalue",
		"showProgressBar": true,
		"options": {
			"backgroundColor": "#ffffff"
		},
		"title": "Does have a progress bar",
		"description": "Due to single viz override",
		"dataSources": {
			"primary": "ds_5Bz2VyBy"
		}
	},
	"viz_SpW3iWQQ": {
		"type": "splunk.line",
		"options": {
			"backgroundColor": "white"
		},
		"dataSources": {
			"primary": "ds_sJ1sIAyM_ds_E4bbdtwS"
		},
		"title": "Does not have a progress bar",
		"description": "Due to global defaults"
	},
	"viz_72zdhYuK": {
		"type": "splunk.area",
		"options": {
			"backgroundColor": "white"
		},
		"dataSources": {
			"primary": "ds_WlKpQPzF_ds_E4bbdtwS"
		},
		"title": "Does not have a progress bar",
		"description": "Viz setting overrides area viz default"
	}
},
"dataSources": {
	"ds_E4bbdtwS": {
		"type": "ds.search",
		"options": {
			"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
		},
		"name": "timechart_search"
	},
	"ds_o7IqGHcO": {
		"type": "ds.search",
		"options": {
			"queryParameters": {
				"earliest": "0",
				"latest": ""
			},
			"query": "index=_internal \n| stats count"
		},
		"name": "Search_1"
	},
	"ds_5Bz2VyBy": {
		"type": "ds.search",
		"options": {
			"queryParameters": {
				"earliest": "@mon",
				"latest": "now"
			},
			"query": "index=_internal \n|  stats count"
		},
		"name": "Search_2"
	},
	"ds_sJ1sIAyM_ds_E4bbdtwS": {
		"type": "ds.search",
		"options": {
			"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
		},
		"name": "Copy of timechart_search"
	},
	"ds_WlKpQPzF_ds_E4bbdtwS": {
		"type": "ds.search",
		"options": {
			"query": "index=\"_internal\" | where isnum(status) and status >200 | timechart count by status"
		},
		"name": "Copy of timechart_search"
	}
},
"inputs": {},
"layout": {
	"type": "absolute",
	"options": {
		"width": 2350,
		"height": 1090,
		"submitButton": true,
		"showTitleAndDescription": true,
		"display": "auto-scale"
	},
	"structure": [
		{
			"item": "viz_LKLC6aUb",
			"type": "block",
			"position": {
				"x": 20,
				"y": 20,
				"w": 1210,
				"h": 370
			}
		},
		{
			"item": "viz_tpRnLS1I",
			"type": "block",
			"position": {
				"x": 1250,
				"y": 20,
				"w": 510,
				"h": 310
			}
		},
		{
			"item": "viz_d9rHmb6e",
			"type": "block",
			"position": {
				"x": 1780,
				"y": 20,
				"w": 540,
				"h": 310
			}
		},
		{
			"item": "viz_SpW3iWQQ",
			"type": "block",
			"position": {
				"x": 1260,
				"y": 370,
				"w": 1100,
				"h": 690
			}
		},
		{
			"item": "viz_72zdhYuK",
			"type": "block",
			"position": {
				"x": -20,
				"y": 410,
				"w": 1250,
				"h": 600
			}
		}
	]
},
"defaults": {
	"visualizations": {
		"global": {
			"showProgressBar": false,
                         "showLastUpdated": true
		},
		"splunk.area": {
			"showProgressBar": true
		}
	}
},
	"description": "",
	"title": "Defaults example"
}

In the defaults section of the dashboard definition you can see that only the area visualizations should show progress bars because the global setting for all visualizations, except area charts, is set to false.

"defaults": {
		"visualizations": {
			"global": {
				"showProgressBar": false
			},
			"splunk.area": {
				"showProgressBar": true
			}
		}

However, you'll notice that the single value visualizations do have progress bars. This is because the property was defined at the component level of the individual visualization stanzas.

Options you can use in the defaults section

Set properties in the dataSource or visualizations stanzas under global or specify individual visualization types or data source types.

option or property	type	default	description
refresh (data sources only)	string	n/a	Specify the refresh interval with a time expression. For example, "5s" for five seconds or "1m" for one minute. See refreshType and refresh example.
refreshType (data sources only)	(delay | interval)	delay	Indicate the starting time for a search to refresh. Use delay to start the countdown to refresh when the search is done. Use interval to countdown when the search is dispatched. See refreshType and refresh example.
queryParameters.earliest (data sources only)	string	n/a	Specify the earliest time to search for events. Choose from year (y), month (m), week (w), day (d), minute (m), second (s), or 0 for all time. For example, if you want to run a search that runs for all time, see The queryParameters example. Defaults with "earliest": "$global_time.earliest$".
queryParameters.latest (data sources only)	string	n/a	Specify the latest time to search for events. Choose from year (y), month (m), week (w), day (d), minute (m), second (s), or 0 for all time. For example, if you want to run a search that runs for all time, see The queryParameters example. Defaults with "latest": "$global_time.latest$".
showProgressBar (visualizations only)	boolean	false	Specify whether to show a loading progress bar for a visualization. You can set the progress bar at the component level at the same level as options. These settings are not options but properties. You set the properties at the same level as the options field.
showLastUpdated (visualizations only)	boolean	false	Specify whether to show the last time a visualization was updated. This time is shown on the bottom of a visualization in a tag in both Edit mode and View mode. These settings are not options but properties. You set the properties at the same level as the options field.

Adding a progress bar to a small visualization might make the visualization too small to show data. If this occurs, increase the visualization's size until you can see your data.

It is important to note that if you have defined an option in a data source stanza, it will override the same option set in defaults for that stanza only.

Don't specify default intervals of time that are too short. Any interval less than one minute might not give the search jobs enough time to run, or may have a heavy performance impact on your dashboard. You can specify a string with the interval, such as "1m" for one minute. If you specify an integer without a time unit, the default unit is seconds.