I have truncated graph in dashboards "User Logon Failures" and "User Utilization" (does not show all data). When I launch the search command in search view, it's work well.
I find a solution. There's a limit (10000 events) with module, so I modify the search (file sec_logon_fail.xml) with bucket and stats to solve this problem.
I find a solution. There's a limit (10000 events) with module, so I modify the search (file sec_logon_fail.xml) with bucket and stats to solve this problem.
please mark it as the answer if it worked for you