# Keep Grafana log queries responsive to dashboard zoom with time macros

> Why can replacing Grafana time macros with a fixed ago filter stop a log chart from following zoom?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:19+00:00
- Modified: 2026-09-10T01:23:49+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

Why can replacing Grafana time macros with a fixed ago filter stop a log chart from following zoom?

## Potentially affected

Azure Monitor log queries in Grafana panels that should respond to dashboard time-range and zoom changes.

## DSE recommendation

Decide whether the panel should follow dashboard time before replacing its macros with a fixed query window.

## Article

## Source facts

The Azure Monitor Grafana plugin supports time macros such as $__timeFilter() and $__interval. They dynamically calculate the time range and time grain when a chart is zoomed. Microsoft’s guide warns that replacing those macros with a standard fixed filter, such as a one-hour ago condition, removes that zoom behavior. Its log-panel setup selects Dashboard for the time range. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to).

## Applicability

Use this query review when a dashboard is intended for interactive time investigation. A deliberately fixed-window panel may be useful, but that choice should be apparent to its readers rather than mistaken for a working zoom control.

## DSE recommendation

Decide whether the panel should follow dashboard time before replacing its macros with a fixed query window. Have the panel owner describe the expected behavior for both a broad overview and a selected incident interval. Preserve the appropriate macros where interaction is intended. Where a fixed window is deliberate, label the panel and explain the boundary so operators do not compare incompatible intervals.

## Verification

Choose a safe historical interval with recognizable events and zoom into a smaller portion. Compare the query’s selected data and grain with the requested dashboard interval, then zoom back out. Review any additional fixed time predicates that might constrain the result despite an interactive setting. Retain the panel configuration and observed interval behavior as evidence; do not infer query correctness solely because the chart remains visually populated.

## Official references

[Microsoft Learn: Azure Monitor with Grafana](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to). Source reviewed September 9, 2026.

## Primary reference

- Name: Use Azure Managed Grafana - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/visualize-use-managed-grafana-how-to
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep Grafana log queries responsive to dashboard zoom with time macros,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-277-keep-grafana-log-queries-responsive-to-dashboard-zoom-with-time-macros/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.