{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "slug": "dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros", "url": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/" }, "title": "Keep Grafana log queries responsive to dashboard zoom with time macros", "summary": "Why can replacing Grafana time macros with a fixed ago filter stop a log chart from following zoom?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:19+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 244, "potentially_affected": "Azure Monitor log queries in Grafana panels that should respond to dashboard time-range and zoom changes.", "dse_recommendation": "Decide whether the panel should follow dashboard time before replacing its macros with a fixed query window.", "primary_source": { "name": "Use Azure Managed Grafana - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The Azure Monitor Grafana plugin supports time macros such as $__timeFilter() and $__interval. They dynamically calculate the time range and time grain when a chart is zoomed. Microsoft’s guide warns that replacing those macros with a standard fixed filter, such as a one-hour ago condition, removes that zoom behavior. Its log-panel setup selects Dashboard for the time range. Microsoft Learn.

\n

Applicability

\n

Use this query review when a dashboard is intended for interactive time investigation. A deliberately fixed-window panel may be useful, but that choice should be apparent to its readers rather than mistaken for a working zoom control.

\n

DSE recommendation

\n

Decide whether the panel should follow dashboard time before replacing its macros with a fixed query window. Have the panel owner describe the expected behavior for both a broad overview and a selected incident interval. Preserve the appropriate macros where interaction is intended. Where a fixed window is deliberate, label the panel and explain the boundary so operators do not compare incompatible intervals.

\n

Verification

\n

Choose a safe historical interval with recognizable events and zoom into a smaller portion. Compare the query’s selected data and grain with the requested dashboard interval, then zoom back out. Review any additional fixed time predicates that might constrain the result despite an interactive setting. Retain the panel configuration and observed interval behavior as evidence; do not infer query correctness solely because the chart remains visually populated.

\n

Official references

\n

Microsoft Learn: Azure Monitor with Grafana. Source reviewed September 9, 2026.

", "content_text": "Source facts\nThe Azure Monitor Grafana plugin supports time macros such as $__timeFilter() and $__interval. They dynamically calculate the time range and time grain when a chart is zoomed. Microsoft’s guide warns that replacing those macros with a standard fixed filter, such as a one-hour ago condition, removes that zoom behavior. Its log-panel setup selects Dashboard for the time range. Microsoft Learn.\nApplicability\nUse this query review when a dashboard is intended for interactive time investigation. A deliberately fixed-window panel may be useful, but that choice should be apparent to its readers rather than mistaken for a working zoom control.\nDSE recommendation\nDecide whether the panel should follow dashboard time before replacing its macros with a fixed query window. Have the panel owner describe the expected behavior for both a broad overview and a selected incident interval. Preserve the appropriate macros where interaction is intended. Where a fixed window is deliberate, label the panel and explain the boundary so operators do not compare incompatible intervals.\nVerification\nChoose a safe historical interval with recognizable events and zoom into a smaller portion. Compare the query’s selected data and grain with the requested dashboard interval, then zoom back out. Review any additional fixed time predicates that might constrain the result despite an interactive setting. Retain the panel configuration and observed interval behavior as evidence; do not infer query correctness solely because the chart remains visually populated.\nOfficial references\nMicrosoft Learn: Azure Monitor with Grafana. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nThe Azure Monitor Grafana plugin supports time macros such as $__timeFilter() and $__interval. They dynamically calculate the time range and time grain when a chart is zoomed. Microsoft’s guide warns that replacing those macros with a standard fixed filter, such as a one-hour ago condition, removes that zoom behavior. Its log-panel setup selects Dashboard for the time range. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to).\n\n## Applicability\n\nUse this query review when a dashboard is intended for interactive time investigation. A deliberately fixed-window panel may be useful, but that choice should be apparent to its readers rather than mistaken for a working zoom control.\n\n## DSE recommendation\n\nDecide whether the panel should follow dashboard time before replacing its macros with a fixed query window. Have the panel owner describe the expected behavior for both a broad overview and a selected incident interval. Preserve the appropriate macros where interaction is intended. Where a fixed window is deliberate, label the panel and explain the boundary so operators do not compare incompatible intervals.\n\n## Verification\n\nChoose a safe historical interval with recognizable events and zoom into a smaller portion. Compare the query’s selected data and grain with the requested dashboard interval, then zoom back out. Review any additional fixed time predicates that might constrain the result despite an interactive setting. Retain the panel configuration and observed interval behavior as evidence; do not infer query correctness solely because the chart remains visually populated.\n\n## Official references\n\n[Microsoft Learn: Azure Monitor with Grafana](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "url": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep Grafana log queries responsive to dashboard zoom with time macros", "item": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "url": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/", "headline": "Keep Grafana log queries responsive to dashboard zoom with time macros", "description": "Why can replacing Grafana time macros with a fixed ago filter stop a log chart from following zoom?", "abstract": "Why can replacing Grafana time macros with a fixed ago filter stop a log chart from following zoom?", "articleBody": "Source facts\nThe Azure Monitor Grafana plugin supports time macros such as $__timeFilter() and $__interval. They dynamically calculate the time range and time grain when a chart is zoomed. Microsoft’s guide warns that replacing those macros with a standard fixed filter, such as a one-hour ago condition, removes that zoom behavior. Its log-panel setup selects Dashboard for the time range. Microsoft Learn.\nApplicability\nUse this query review when a dashboard is intended for interactive time investigation. A deliberately fixed-window panel may be useful, but that choice should be apparent to its readers rather than mistaken for a working zoom control.\nDSE recommendation\nDecide whether the panel should follow dashboard time before replacing its macros with a fixed query window. Have the panel owner describe the expected behavior for both a broad overview and a selected incident interval. Preserve the appropriate macros where interaction is intended. Where a fixed window is deliberate, label the panel and explain the boundary so operators do not compare incompatible intervals.\nVerification\nChoose a safe historical interval with recognizable events and zoom into a smaller portion. Compare the query’s selected data and grain with the requested dashboard interval, then zoom back out. Review any additional fixed time predicates that might constrain the result despite an interactive setting. Retain the panel configuration and observed interval behavior as evidence; do not infer query correctness solely because the chart remains visually populated.\nOfficial references\nMicrosoft Learn: Azure Monitor with Grafana. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:27:19+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Grafana log queries responsive to dashboard zoom with time macros" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 244, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use Azure Managed Grafana - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to" } } ] } }