Dashboards & Visualizations
Highlighted

Avoid macro expansion

Contributor

I defined a huge search macro and use it in some of my panels. (used this to define a lot of false positives like "xxx" OR "yyy" OR ...)
Now - every time someone clicks the panel cell or row the macro gets expanded and fills half of the screen.
Is there a way to avoid the expansion and still see the macro name on clicks in panels?

0 Karma
Highlighted

Re: Avoid macro expansion

Splunk Employee
Splunk Employee

If you are using a saved search, check the nosubstitution in the savedsearch command.

Highlighted

Re: Avoid macro expansion

Contributor

Are there savedsearches in splunk 6 panels? All my panel searches are inline searches. I'll check if I can save most of them and use them from the panels, thanks.

0 Karma
Highlighted

Re: Avoid macro expansion

Contributor

Ahhh - worse. Those are "| pivot" panels.

0 Karma