Fortianalyser Report has different data than Dataset test

Hello,

I'm trying to configure a report to check how many times my user had succefully login with the VPN and when was the las time. 

This is my Dataset:

select  (`user`) as usager,

           sum((case when reason='login successfully' then 1 else 0 end)) as total, from_dtime(max(coalesce(dtime, 0))) as end_time 

from $log

where $filter and reason='login successfully' 

group by usager, total

order by total desc

When I ran the test dataset, I have good results, but not when I run the report for example:

From data test user pinla11 has been logged 6 times and last time was 27/02/2019

At the report, I have two differents entries:

pinla11 3 times  02/02/2019

pinla11 3 times  26/02/2019

I had try evrithing I found in the Internet, nothing work..

can anyone help me?

Thanks in advance..