I am new to Splunk and have been tasked with creating a dashboard that will show detail about account lockout events. Specifically when an administrator account has been locked out, why and on what device. I don't need anything fancy right now just something that works and I can add more to it later. I have evaluated other answers to similar questions and can't seem to get any of them to work but they also seem to be more complex and I can't decipher them yet because of my limited splunk knowledge.
Assuming you are working on windows security logs for this.
Running the following SPL will give you the statics you stated above:
index="YourIndex" sourcetype="Your Windows sourcetype" EventCode=4740 |stats count values(user) as user values(signature) as action by src | rename src as Source
You might need to check for any field name changes or other tweaks that you may require.
After running the SPL, you can save it as a dashboard panel. At Dashboard panel you can further have the options of working with the visulaizations.