Create a custom chart based on an investigation

Security dashboard & security investigation tool

Supported editions for this feature: Enterprise; Education Standard and Plus.  Compare your edition

As an administrator, you can create a custom chart in the dashboard that's based on a search you've entered in the investigation tool. You can only create custom charts for data sources that are based on log events. For example, you can create a custom chart for Gmail log events but not for Gmail messages.

Note: Each administrator can create a maximum of 25 custom charts.

To create a custom chart based on an investigation:

  1. Start a search in the investigation tool.
    For instructions, see Customize searches with the investigation tool.
  2. From the Investigation page, click the "" icon in the upper-right corner of the page, and select Create custom chart.
  3. In the Create dashboard widget from search window, enter a title and short description for your custom chart.
  4. From the widget, preview how your chart will appear on the Dashboard.
  6. To view your new chart on the dashboard, from the left menu, go to Security > Dashboard. The new chart is now visible as the top-left chart on your dashboard.
  7. Optional: From the dashboard, click the Customize dashboard  icon in the upper-right corner of the page. 
    While customizing the dashboard, you can move this newly created custom chart to any location on the dashboard, or you can later delete the chart if you no longer need it.

You can also start an investigation based on some of the Dashboard charts. For instructions, see Start an investigation based on a dashboard chart.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Clear search
Close search
Google apps
Main menu
Search Help Center