How to create a widget based off rule, filter, query. Example UserFailedLogon.FailureCount for the last 30 days but I want to be use that as widget in my dashboard

For Example User failed logon for the last 30 days but I want to be use that as widget in my dashboard. SEM dashboard only has a handful of widgets

Find more posts tagged with

Would something like this be what you are looking for?

Went to the Dashboards tab and clicked "Edit Dashboard", then clicked "Add Widget"
For the widget type I selected "*New Time Series Widget - Long Term*" and then clicked "customize" on the bottom right of the screen
In the resulting "Creating Widget" dialog, I
- Clicked into the "Filter" section and told it to use a pre-existing filter called Failed Logons (but I could have chosen any filter that I had made on the "Live Events" tab instead)
- Clicked into the "Title and Description" section and named it Failed Logons - Last 30 days
- Clicked into the "Timeseries metadata" section and set the Starting Timespan to 30 days instead of the default 7 days
- Clicked "Create widget" on the bottom right

This is a slightly different variant, where I made 2 changes:

I limited this one to 7 days
In the "Filter and Property" section I chose Failed Logons as the filter (just like the previous one) but I also chose Destination Account for the "Properties (optional)" field.