Supported editions for this feature: Enterprise; Enterprise for Education. Compare your edition
As an administrator, you can create a custom chart in the dashboard that's based on a search you've entered in the investigation tool. You can only create custom charts for data sources that are based on log events. For example, you can create a custom chart for Gmail log events but not for Gmail messages.
To create a custom chart based on an investigation:
- Start a search in the investigation tool.
For instructions, see Customize searches with the investigation tool.
- From the Investigation page, click the icon in the upper-right corner of the page, and select Create custom chart.
- In the Create dashboard widget from search window, enter a title and short description for your custom chart.
- From the widget, preview how your chart will appear on the Dashboard.
- Click SAVE TO DASHBOARD.
- To view your new chart on the dashboard, from the left menu, go to Security > Dashboard. The new chart is now visible as the top-left chart on your dashboard.
- Optional: From the dashboard, click the Customize dashboard icon in the upper-right corner of the page.
While customizing the dashboard, you can move this newly created custom chart to any location on the dashboard, or you can later delete the chart if you no longer need it.
You can also start an investigation based on some of the Dashboard charts. For instructions, see Start an investigation based on a dashboard chart.