Thank you for the feedback, we could add some clarification about this to the documentation. There are 3 places where default values come into play for custom visualizations. You can get away with not setting them all, but for the best user experience, it is a good idea to. They are:
savedsearches.conf : these values are indeed meaningful. They will be the values passed to your viz in it's config on page load. You can handle these any way you see fit, but most vizes will pick up those values and use them, so good defaults there is a good idea.
formatter.html : setting defaults on the inputs in this file is not strictly necessary, but if you set them to something other than the defaults you have in savedsearches.conf , they will get set to those new values when the formatter is opened.
I agree it's not optimal to have 3 places to set this, but again, things will pretty much work if you only use the ones in savedsearches.conf. To accomplish your scenario of having a common globally settable property, used savedsearches.conf . Note that users can set their own defaults be having a local/savedsearches.conf as elsewhere in Splunk.
... View more