Skip to main content
mario_thenetworkguy
mario_thenetworkguy
New Member
June 13, 2025
Question

FortiAnalyzer Custom Report

  • June 13, 2025
  • 2 replies
  • 1396 views

Hello,

 

I am having an issue when generating a custom report on FortiAnalyzer.

I have created a custom dataset, added it to a chart and when I run it from here with real data, the table is showing successfully with data.

The issue is when I need to add this chart into a report and run it, I always get in the pdf report No matching log data for this report but when I run it directly from the chart tab it is working.

Below is the dataset created, appreciate your help why in the report it is not working


SELECT
srcip,
dstip,
action,
policyid,
user,
$calendar_time(itime) AS "time_stamp"
FROM $log
WHERE $filter
AND type = 'traffic'
AND subtype = 'forward'
AND policyid = 120
AND `group` = 'users'
ORDER BY eventtime DESCchart.pngReport.png

 

2 replies

funkylicious
SuperUser
funkylicious
SuperUser
June 13, 2025

hi,

in the report settings, are you defining the correct period of time and also selecting the correct device to run the sql select on logs ?

"jack of all trades, master of none"
mario_thenetworkguy
mario_thenetworkguyAuthor
New Member
June 13, 2025

Hello,

Thanks for ur reply, yes I have specified yesterday same as when I run it on the chart, and the device is selected to all (I only have one FGT connected to Analyzer)report config.png

funkylicious
SuperUser
funkylicious
SuperUser
June 13, 2025

ok, then it's really strange.

i created a really quick report / chart / dataset with the following select and worked just fine.

 

SELECT
srcip,
dstip,
action,
policyid,
user,
$calendar_time(itime) AS "time_stamp"
FROM $log
WHERE $filter
AND type = 'traffic'
AND subtype = 'forward'
ORDER BY eventtime DESC

 

L.E. maybe you have some kind of filter under the report settings. also, although you have only a FGT in the ADOM try selecting it.

"jack of all trades, master of none"
filiaks1
filiaks1
Explorer III
June 30, 2025

Strange ::ffff in the report for source/destination ip seems to match 839350 (Resolved Issues | FortiAnalyzer 7.2.2 | Fortinet Document Library ) . It should be resolved for the logs but maybe for the reports it is in 7.6.x as @mario_thenetworkguy  mentioned that his version is ok.

Terms & ConditionsAccessibility statement