DashboardDashboards Guide

The Event : Approx Log Time filter sets the time range for the event data. The default setting is in the last 7 days. You can update this filter with a wide range of customizable settings.

To update the time range filter, click the arrow () on the right, under the Edit button, to expand the filters panel. In the Event : Approx Log Time filter, select an operator from the first drop down menu and then enter or select values in the subsequent fields, depending on the operator you selected. To save your filter changes, click Apply on the right side of the filter panel. The updated filter is applied to the visualization.

This single value bar chart displays the number of unique users with failed application logons within the selected time range.

This pie chart illustrates the count proportions of the top five most common reasons that application logon attempts failed. To view the represented values, hover your pointer over the graph slices. To drill down into a value and view the underlying events, click the graph slice, and then click Show Results in Search.

This pie chart illustrates the count proportions of the top five applications that have the most logon failures. To view the represented values, hover your pointer over the graph slices. To drill down into a value and view the underlying events, click the graph slice, and then click Show Results in Search.

This line graph shows the count trends of failed application activity over the selected time range. To view the values represented in the chart, hover your pointer over the graph lines to display the data points. To view the underlying events of a value, click the data point, and then click Show Results in Search.

This table provides details about the top 10 users with the most application logon failures, including user names and failure counts. Click the heading of the column that you want to sort the data by. Click the arrow icon to change between ascending () and descending () orders. To view all the table rows, you may need to use the scroll bar on the right.

To view the underlying events, in the Count column, click a count value and then click Show Results in Search.

This table provides details on recent failed application logon events, including their times, subject, activity, outcomes, application, failure reason, source IPs, and object. Click the heading of the column that you want to sort the data by. Click the arrow icon to change between ascending () and descending () orders. To view all the table rows, you may need to use the scroll bar on the right.