Troubleshooting Tip: FortiAnalyzer custom report filter not working due to missing 'filter' info at dataset

Below is the scenario:

At FortiAnalyzer (Device Manager), 2 FortiGates have been added.

For example:  

• 'FGT_HQ'.
• 'FGT_Branch'.

At FortiAnalyzer, the '10.100.5.172' IP address is only inside 'FGT_HQ' logs.

At FortiAnalyzer, the Dataset information is as follows.

At FortiAnalyzer, generate the report, and the result shows more information that is not included in the filter for FortiGate.

Below is the comparison between 2 different datasets and 2 different results.

Correct the dataset as follows:

SELECT

          from_dtime(dtime) as time,

    devname,

    policyid,

    srcip,

    dstip,

    hostname,

    catdesc,

          utmaction

FROM

          $log

WHERE

          $filter AND utmaction = 'block'

ORDER BY

          dtime DESC

Related article:
Technical Tip: How to create FortiAnalyzer reports using custom SQL queries