I defined a huge search macro and use it in some of my panels. (used this to define a lot of false positives like "xxx" OR "yyy" OR ...)
Now - every time someone clicks the panel cell or row the macro gets expanded and fills half of the screen.
Is there a way to avoid the expansion and still see the macro name on clicks in panels?
If you are using a saved search, check the nosubstitution
in the savedsearch command.
Ahhh - worse. Those are "| pivot" panels.
Are there savedsearches in splunk 6 panels? All my panel searches are inline searches. I'll check if I can save most of them and use them from the panels, thanks.