Create a custom chart based on an investigation

As an administrator, you can create a custom chart in the dashboard that's based on a search you've entered in the investigation tool. You can only create custom charts for data sources that are based on log events. For example, you can create a custom chart for Gmail log events but not for Gmail messages.

Note: Each administrator can create a maximum of 25 custom charts.

Your access to the security investigation tool

• The security investigation tool requires a premium Google Workspace edition (Enterprise Plus, Enterprise Standard, or Education Plus).
• You can access logs using the Chrome browser for the Google apps you have installed. For example, Gmail.
• Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can use the audit and investigation page instead. 
• You can run a search in the investigation tool on all users, regardless of the Google edition they have.

Create a chart based on an investigation

1. Start a search in the investigation tool.
   For instructions, see Customize searches with the investigation tool.
2. From the Investigation page, click the  icon in the upper-right corner of the page, and select Create custom chart.
3. In the Create dashboard widget from search window, enter a title and short description for your custom chart.
4. From the widget, preview how your chart will appear on the Dashboard.
5. Click SAVE TO DASHBOARD.
6. To view your new chart on the dashboard, from the left menu, go to Security > Dashboard. The new chart is now visible as the top-left chart on your dashboard.
7. Optional: From the dashboard, click the Customize dashboard  icon in the upper-right corner of the page. 
   While customizing the dashboard, you can move this newly created custom chart to any location on the dashboard, or you can later delete the chart if you no longer need it.

You can also start an investigation based on some of the Dashboard charts. For instructions, see Start an investigation based on a dashboard chart.