This is the search that we are using for the dashboard and it brings all events with value "-".
index=wineventlog EventCode=4625 host=* Account_Name!=*$ | stats count by Account_Name
| eventstats sum(count) as Failures by count | table Account_Name, Failures | sort -Failures
Advise about what? What are your desired results?
Do you see the SID reported in those events?
If so, it may be that you do not have evt_resolve_ad_obj = 1 set on the inputs.conf stanza for the security event log.
evt_resolve_ad_obj = 1
This setting will force the Splunk UF to try to resolve the SID to a user account
See this post, where I made a few suggestions on how to address this