Here is the report and yes I know it will work if I make it a inline search in the dashboard, but you can't set dashboards to run as the "Owner" which is what I need it to do. The report I can set to run as owner.
index=main EventCode=4740 Account_Name=$field1$
| eval Account_Name2=mvindex(Account_Name,1), mytime=_time
| convert timeformat="%m-%d-%Y %I:%M:%S %p" ctime(mytime)
| dedup _time
| table Account_Name2, Caller_Computer_Name, mytime
| rename Account_Name2 AS "Account Locked Out", Caller_Computer_Name AS "Lockout Location", mytime AS "Date/Time"
| sort _time
... View more