How are dataset variables used?

Hello

After several hours testing the Fortianalyzer, I discovered how the dataset variables works: It's used inside the variable $filter to replace the standard "where" clause generate by the fortianalyzer Example: Let's assume that I have the following dataset select coalesce(nullifna(`user`),ipstr('srcip')) as user_src, root_domain(hostname) as website_domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where $filter group by user_src, website_domain In the dataset, I created the following variable: Variable: Group Expression: lower(coalesce(nullifna(`user`),'empty''))) Description: Users in Group In the report that I use this dataset, we want to filter users from a specific Active Directory group. So we need to go to the "Advanced Settings" tab in the report and add a filter "Group (group)" Equal to "Group from AD". In this tab, we also need to check the option "LDAP Query" and set the LDAP Server. The group "Group from AD" has the following users: john, david, peter Now when I run the report, the Fortianalyzer replaces the $filter for: select coalesce(nullifna(`user`),ipstr('srcip')) as user_src, root_domain(hostname) as website_domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where lower(coalesce(nullifna(`user`), 'empty')) in ('john','david','peter')  group by user_src, website_domain When we remove this variable, the query change to: select coalesce(nullifna(`user`),ipstr('srcip')) as user_src, root_domain(hostname) as website_domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where (`user`) in ('john','david','peter')  group by user_src, website_domain In this example, my Active Directory store the username in lower case, but the fortianalyzer record the username in uppercase. Since the Postgres is case sensitive, I used the funcion "lower()" (from Postgres), to change the case from the value stored in the "user" field. I am learning english, so I sorry about the grammar and other errors. Thanks Diego