Drill down on dashboard is showing large search

[Bliide]

I have a few dashboards that display different information about top browsers. I have created a

| replace "long string here" with "user friendly here" in cs_User_Agent

in the search on each dashboard that replaces the IIS log cs_User_Agent value with something more understandable for the user. This replace has grown larger and larger with all the different cs_User_Agent values generated by the IIS logs. When the user clicks to drill down on one of the values on the browser dashboards it takes them to the event tab. The search is displayed and the search is very large. Is there a way to not have the search field expanded when they drill down?

[aweitzman]

You could create a CSV file for all the information that you're putting in the replace phrase, and then use it as the basis of a static lookup. I followed these instructions and they worked like a charm:

http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Addfieldsfromexternaldatasources

Once you've done that, your drilldowns should become more coherent since they'll be working on the new field with the friendly name, and all the information currently in the replace phrase won't need to be in the search proper.

[somesoni2]

You can define your custom drilldowns.