truncated graph "User logon failure"

[nicolas_rofort]

I have truncated graph in dashboards "User Logon Failures" and "User Utilization" (does not show all data). When I launch the search command in search view, it's work well.

[nicolas_rofort · Accepted solution]

I find a solution. There's a limit (10000 events) with module, so I modify the search (file sec_logon_fail.xml) with bucket and stats to solve this problem.

[linu1988]

please mark it as the answer if it worked for you