As an administrator, you can create a custom chart in the dashboard that's based on a search you've entered in the investigation tool. You can only create custom charts for data sources that are based on log events. For example, you can create a custom chart for Gmail log events but not for Gmail messages.
Note: Each administrator can create a maximum of 25 custom charts.
Your access to the security investigation tool
- Supported editions for the security investigation tool include Enterprise Plus, Education Standard, Education Plus, and Enterprise Essentials Plus.
- Admins with Cloud Identity Premium, Frontline Standard, Enterprise Standard, and Education Standard can also use the investigation tool for a subset of data sources.
- Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can use the audit and investigation page instead. For more information, go to Improved audit and investigation experience.
- You can run a search in the investigation tool on all users, regardless of the Google edition they have.
Create a chart based on an investigation
- Start a search in the investigation tool.
For instructions, see Customize searches with the investigation tool.
- From the Investigation page, click the icon in the upper-right corner of the page, and select Create custom chart.
- In the Create dashboard widget from search window, enter a title and short description for your custom chart.
- From the widget, preview how your chart will appear on the Dashboard.
- Click SAVE TO DASHBOARD.
- To view your new chart on the dashboard, from the left menu, go to Security > Dashboard. The new chart is now visible as the top-left chart on your dashboard.
- Optional: From the dashboard, click the Customize dashboard icon in the upper-right corner of the page.
While customizing the dashboard, you can move this newly created custom chart to any location on the dashboard, or you can later delete the chart if you no longer need it.
You can also start an investigation based on some of the Dashboard charts. For instructions, see Start an investigation based on a dashboard chart.