Dashboards & Visualizations

How do I correctly set defaults for modular visualizations?

jeffland
SplunkTrust
SplunkTrust

Regarding defaults for the settings available via the format menu, the docs say

Use savedsearches.conf to indicate visualization property default values.
- Note: Set property defaults and handle user-configured property values in visualization_source.js.

Does this mean that savedsearches.conf is only used to "indicate" the defaults for other potential developers who might use and continue to develop my code? And that the settings in savedsearches.conf are never actually used anywhere because only those settings set in my .js code are relevant? Why would I define defaults both in savedsearches.conf and in my .js directly?
Also, if I'm supposed to use either (or both) of the above methods, what is the reason behind having values in formatter.html as well? I understand that the format menu can show an empty field while the viz uses a (non-empty) default value behind the scenes, but at the moment there seem to be three places where I can define them and they can all be different and have different effects. I would like to have one place (and one place only) where they are set, and the possibility to access that global setting from wherever it is used, e.g. in my .js and in my format menu. I'm thinking of having that default available as a variable, for example like {{VIZ_NAMESPACE}} in the format menu html file.

1 Solution

magnew_splunk
Splunk Employee
Splunk Employee

Hi @jeffland,

Thank you for the feedback, we could add some clarification about this to the documentation. There are 3 places where default values come into play for custom visualizations. You can get away with not setting them all, but for the best user experience, it is a good idea to. They are:

  1. savedsearches.conf: these values are indeed meaningful. They will be the values passed to your viz in it's config on page load. You can handle these any way you see fit, but most vizes will pick up those values and use them, so good defaults there is a good idea.
  2. formatter.html: setting defaults on the inputs in this file is not strictly necessary, but if you set them to something other than the defaults you have in savedsearches.conf, they will get set to those new values when the formatter is opened.
  3. javascript: as I said, you will get the default values from savedsearches.conf passed to you, but it's not a bad idea to have the same fallbacks set in javascript, essentially as defensive coding. If a user deletes or changes savedsearches.conf, your javascript will still run. Most vizes will do this just by having a fallback in the variable assignment like var maxValue = parseFloat(config[this.getPropertyNamespaceInfo().propertyNamespace + 'maxValue']) || 100;. That will get the max value property from the config, but has a defensive fallback to 100. This used to be more important because older versions of Splunk didn't pass the savedsearches properties in dashboards. But I believe that is fixed now.

I agree it's not optimal to have 3 places to set this, but again, things will pretty much work if you only use the ones in savedsearches.conf. To accomplish your scenario of having a common globally settable property, used savedsearches.conf. Note that users can set their own defaults be having a local/savedsearches.conf as elsewhere in Splunk.

View solution in original post

magnew_splunk
Splunk Employee
Splunk Employee

Hi @jeffland,

Thank you for the feedback, we could add some clarification about this to the documentation. There are 3 places where default values come into play for custom visualizations. You can get away with not setting them all, but for the best user experience, it is a good idea to. They are:

  1. savedsearches.conf: these values are indeed meaningful. They will be the values passed to your viz in it's config on page load. You can handle these any way you see fit, but most vizes will pick up those values and use them, so good defaults there is a good idea.
  2. formatter.html: setting defaults on the inputs in this file is not strictly necessary, but if you set them to something other than the defaults you have in savedsearches.conf, they will get set to those new values when the formatter is opened.
  3. javascript: as I said, you will get the default values from savedsearches.conf passed to you, but it's not a bad idea to have the same fallbacks set in javascript, essentially as defensive coding. If a user deletes or changes savedsearches.conf, your javascript will still run. Most vizes will do this just by having a fallback in the variable assignment like var maxValue = parseFloat(config[this.getPropertyNamespaceInfo().propertyNamespace + 'maxValue']) || 100;. That will get the max value property from the config, but has a defensive fallback to 100. This used to be more important because older versions of Splunk didn't pass the savedsearches properties in dashboards. But I believe that is fixed now.

I agree it's not optimal to have 3 places to set this, but again, things will pretty much work if you only use the ones in savedsearches.conf. To accomplish your scenario of having a common globally settable property, used savedsearches.conf. Note that users can set their own defaults be having a local/savedsearches.conf as elsewhere in Splunk.

jeffland
SplunkTrust
SplunkTrust

Thank you for your answer, and for considering adding the topic to the documentation. I agree that the system works well and you can properly use it, but more so if you know what you're doing.
One thing though: if I use var maxValue = parseFloat(config[this.getPropertyNamespaceInfo().propertyNamespace + 'maxValue']) || 100; in my javascript, I will not be able to set the option in the format menu to "0" or anything that is evaluated to false in javascript:

var x = 0 || 100;
>>> x == 100

That can easily be avoided by a more elaborate conditional statement (checking for undefined), maybe the docs should not recommend the ||-method.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Edit: Please see magnew's answer below as I was a little off

I think they all serve different purposes:

  • savedsearches.conf is for letting other users know about the defaults, without asking them to look through your javascript source code. This seems like a best practice to me and more of a pleasantry.
  • the default values themselves are set in the javascript - this is necessary at some point of course.
  • the values in the formatter are for exposing those defaults in the UI

I agree having them all in one place would be ideal.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Thank you for sharing your thoughts, I have a similar feeling for purpose of three places. The documentation could be a bit more elaborate regarding this topic, but I also understand that this is a pretty new feature and will possibly see further development. At the moment both the feature and the documentation seem kind of rushed.

0 Karma

magnew_splunk
Splunk Employee
Splunk Employee

Thanks for the feedback. If there are other custom viz topics you would like to see more detail on in the docs, let us know.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...