Create a custom chart based on an investigation

As an administrator, you can create a custom chart in the dashboard that's based on a search you entered in the security investigation tool. You can only create custom charts for data sources that are based on log events. For example, you can create a custom chart for Gmail log events but not for Gmail messages.

Note: Each administrator can create a maximum of 25 custom charts.

Create a chart based on an investigation

1. Start a search in the security investigation tool.
   For instructions, see Customize searches with the investigation tool.
2. From the Investigation page, click the  icon in the upper-right corner of the page, and select Create custom chart.
3. In the Create dashboard widget from search window, enter a title and short description for your custom chart.
4. From the widget, preview how your chart will appear on the Dashboard.
5. Click SAVE TO DASHBOARD.
6. To view your new chart on the dashboard, from the left menu, go to Security > Dashboard. The new chart is now visible as the top-left chart on your dashboard.
7. Optional: From the dashboard, click the Customize dashboard  icon in the upper-right corner of the page. 
   While customizing the dashboard, you can move this newly created custom chart to any location on the dashboard, or you can later delete the chart if you no longer need it.

You can also start an investigation based on some of the Dashboard charts. For instructions, see Start an investigation based on a dashboard chart.