https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183074#M11285 <P>Ahhh - worse. Those are "| pivot" panels.</P> Wed, 18 Dec 2013 14:53:47 GMT FRoth 2013-12-18T14:53:47Z https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183071#M11282 <P>I defined a huge search macro and use it in some of my panels. (used this to define a lot of false positives like "xxx" OR "yyy" OR ...)<BR /> Now - every time someone clicks the panel cell or row the macro gets expanded and fills half of the screen.<BR /> Is there a way to avoid the expansion and still see the macro name on clicks in panels?</P> Wed, 18 Dec 2013 13:35:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183071#M11282 FRoth 2013-12-18T13:35:18Z https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183072#M11283 <P>If you are using a saved search, check the <CODE>nosubstitution</CODE> in the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch">savedsearch</A> command.</P> Wed, 18 Dec 2013 14:03:31 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183072#M11283 jtrucks 2013-12-18T14:03:31Z https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183073#M11284 <P>Are there savedsearches in splunk 6 panels? All my panel searches are inline searches. I'll check if I can save most of them and use them from the panels, thanks.</P> Wed, 18 Dec 2013 14:52:07 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183073#M11284 FRoth 2013-12-18T14:52:07Z https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183074#M11285 <P>Ahhh - worse. Those are "| pivot" panels.</P> Wed, 18 Dec 2013 14:53:47 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Avoid-macro-expansion/m-p/183074#M11285 FRoth 2013-12-18T14:53:47Z