Create a custom chart based on an investigation

You must be an administrator with a G Suite Enterprise, Drive Enterprise, G Suite Enterprise for Education, or Cloud Identity Premium license to access the security center. A subset of features in the investigation tool are available for Cloud Identity Premium.

You can create a custom chart in the dashboard that's based on a search you've entered in the investigation tool. 

Note: You can only create a custom chart for data sources that are based on log events. For example,  you can create a custom chart for Gmail log events but not for Gmail messages.

To create a custom chart based on an investigation:

  1. Start a search in the investigation tool.
    For instructions, see Customize searches with the investigation tool.
  2. From the Investigation page, click the  icon in the upper-right corner of the page.
  3. In the Preview dashboard widget window, type a name for your custom chart.
  4. Click SAVE TO DASHBOARD.
  5. To view the widget for your new chart on the dashboard, click VIEW. The new chart is now visible as the top-left chart in your dashboard.
  6. Optional: From the dashboard, click the Customize dashboard  icon in the upper-right corner of the page. 
    While customizing the dashboard, you can move this newly created custom chart to any location on the dashboard, or you can later delete the chart if you no longer need it.

You can also start an investigation based on some charts on the dashboard. For instructions, see Start an investigation based on a dashboard chart.

Was this helpful?
How can we improve it?