Data source options and properties
You can set various properties in the options field of a data source stanza. Following the JSON format, enclose each property setting in quotes unless it is a boolean value (true, false) or a number. Options other than the last one set must end in a comma.
The following table lists the options that are available for you to use to modify your dataSource stanzas:
| option | type | default | description |
|---|---|---|---|
| app | string | search | Only for ds.savedSearch. Define the app that is associated with a report, or saved search, that you want to use.
|
| query | string | N/A | Write your SPL search using the query.
|
| queryParameters.earliest | string | N/A | All data source time ranges are controlled by a default Global time range picker. To override that setting, specify the earliest time to search for events. Choose from year (y), month (m), week (w), day (d), minute, (m), or second (s), or 0 for all time. For example, if you want to run a search that runs for all time, see The queryParameters example. |
| queryParameters.latest | string | N/A | All data source time ranges are controlled by a default Global time range picker. To override that setting, specify the latest time to search for events. Choose from year (y), month (m), week (w), day (d), minute, (m), or second (s), or an empty string for all time. For example, if you want to run a search that runs for all time, see The queryParameters example. |
| ref | string | N/Z | Only for ds.savedSearch. Enter the exact name of the report you are using. This will allow the Dashboard Studio to pull the report from its location.
|
| refresh | string | N/A | Specify the refresh interval with a time expression. For example, "5s" for five seconds or "1m" for one minute. See refreshType and refresh example. |
| refreshType | (delay | interval) | delay | Indicate the starting time for a search to refresh. Use delay to start the countdown to refresh when the search is done. Use interval to count down when the search is dispatched. See refreshType and refresh example.
|
queryParameters options example
The following example dashboard has 3 pie charts which show top sourcetype data for different time ranges.
Each pie chart is configured with a different data source. Each data source is configured with a different time range in the queryParameters stanza.
The chart on the left shows data for the time range specified by the Select a time: time range picker. In the data source queryParameters, earliest and latest are defined using $TimeRange.earliest$ and $TimeRange.latest$ to set the time range to the one defined by the picker. The following shows the source code for this data source:
"dataSources": {
"search_1": {
"name": "Time range defined by input",
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "$TimeRange.earliest$",
"latest": "$TimeRange.latest$"
}
},
"type": "ds.search"
}The chart in the middle shows all-time data. In the data source queryParameters, latest is defined as 0. The following shows the source code for this data source:
"dataSources": {
"ds_fge0Uh7L": {
"name": "Time range defined as all time",
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "",
"latest": "0"
}
},
"type": "ds.search"
}
The chart on the right shows data for a specific custom time range from 2025-12-01T23:00:00.000Z to 2025-12-02T00:20:58.475Z. These times are used to define earliest and latest in the data source queryParameters. The following shows the source code for this data source:
"dataSources": {
"ds_A9ktRXe7": {
"name": "Time range defined as specific part of days",
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "2025-12-01T23:00:00.000Z",
"latest": "2025-12-02T00:20:58.475Z"
}
},
"type": "ds.search"
}Expand this box to see the complete dashboard definition. You can copy and paste it into your own instance to view the example at work:
{
"title": "Data Source Custom Time Ranges",
"description": "",
"inputs": {
"input_1": {
"options": {
"defaultValue": "-15m,now",
"token": "TimeRange"
},
"title": "Select a time:",
"type": "input.timerange"
}
},
"visualizations": {
"viz_chart1": {
"dataSources": {
"primary": "search_1"
},
"description": "Top Sourcetypes Between $TimeRange.earliest$ and $TimeRange.latest$ (Time Range Picker)",
"type": "splunk.pie"
},
"viz_rIyQinem": {
"dataSources": {
"primary": "ds_fge0Uh7L"
},
"description": "Top Sourcetypes (All Time)",
"type": "splunk.pie"
},
"viz_vtynMDoC": {
"dataSources": {
"primary": "ds_A9ktRXe7"
},
"description": "Top Sourcetypes between 2025-12-01T23:00:00.000Z and 2025-12-02T00:20:58.475Z",
"type": "splunk.pie"
}
},
"dataSources": {
"ds_A9ktRXe7": {
"name": "Time range defined as specific part of days",
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "2025-12-01T23:00:00.000Z",
"latest": "2025-12-02T00:20:58.475Z"
}
},
"type": "ds.search"
},
"ds_fge0Uh7L": {
"name": "Time range defined as all time",
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "",
"latest": "0"
}
},
"type": "ds.search"
},
"search_1": {
"name": "Time range defined by input",
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "$TimeRange.earliest$",
"latest": "$TimeRange.latest$"
}
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_1"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto-scale",
"height": 1250,
"width": 1200
},
"structure": [
{
"item": "viz_chart1",
"position": {
"h": 260,
"w": 350,
"x": 10,
"y": 10
},
"type": "block"
},
{
"item": "viz_rIyQinem",
"position": {
"h": 260,
"w": 320,
"x": 370,
"y": 10
},
"type": "block"
},
{
"item": "viz_vtynMDoC",
"position": {
"h": 260,
"w": 490,
"x": 700,
"y": 10
},
"type": "block"
}
],
"type": "absolute"
}
},
"options": {
"submitButton": false
},
"tabs": {
"items": [
{
"label": "Overview",
"layoutId": "layout_1"
}
]
}
}
}
refreshType and refresh property example
If you add the refreshType and refresh options to your data source, the visualization refreshes automatically at the interval you specify. In this case, refreshType is set to delay the refresh until the end of the search at an interval of 10 seconds.
Don't specify default intervals of time that are too short in dashboards with many visualizations. Examples that use a refresh interval of under 1 minute are only appropriate for simple dashboards with few visualizations. Any interval less than 1 minute might not give the search jobs enough time to run, or may have a heavy performance impact on your dashboard. You can specify a string with the interval, such as "1m" for 1 minute. If you just specify an integer, without a time unit, the default unit is seconds.
refresh and refreshType setting in the defaults section of the dashboard definition."dataSources": {
"search_1": {
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$TimeRange.earliest$",
"latest": "$TimeRange.latest$"
},
"refreshType": "delay",
"refresh": "10s",
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)"
}
}
},
The following dashboard definition is a modified version of the queryParameters dashboard. The refresh and refreshType options have been added.
Expand this box to see the complete dashboard definition. You can copy/paste it into your own instance.
{
"title": "Time Picker Input Example",
"description": "Add a time range picker to modify a search time span.",
"inputs": {
"input_1": {
"options": {
"defaultValue": "-24h,now",
"token": "TimeRange"
},
"title": "Select a time:",
"type": "input.timerange"
}
},
"visualizations": {
"viz_chart1": {
"dataSources": {
"primary": "search_1"
},
"description": "Chart of Top Sourcetypes between $TimeRange.earliest$ and $TimeRange.latest$",
"options": {},
"showLastUpdated": true,
"showProgressBar": true,
"type": "splunk.pie"
}
},
"dataSources": {
"search_1": {
"options": {
"query": "index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)",
"queryParameters": {
"earliest": "$TimeRange.earliest$",
"latest": "$TimeRange.latest$"
},
"refresh": "10s",
"refreshType": "delay"
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_1"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto-scale",
"height": 1250,
"width": 1200
},
"structure": [
{
"item": "viz_chart1",
"position": {
"h": 530,
"w": 680,
"x": 250,
"y": 80
},
"type": "block"
}
],
"type": "absolute"
}
},
"options": {
"submitButton": false
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
}