Skip to main content
Terrence_M
New Member
April 20, 2016
Question

no data returned for web filter violation report, but shows up in dataset

  • April 20, 2016
  • 2 replies
  • 4017 views

I have built the following data set:

 

Log - Web Filter

select $calendar_time as time, srcip, catdesc, dstip, hostname from $log where $filter and action='blocked' group by time, srcip, catdesc, dstip, hostname order by time, srcip, catdesc, dstip, hostname

 

I built the chart, (see image) but when I go to run the report, it returns no data, even though I matched my report to my dataset testing - last 1 day - same firewall. Can anyone help me figure out what is causing the disconnect between the data set and report?

    2 replies

    hzhao_FTNT
    Staff
    Staff
    April 20, 2016

    Hi there, I am not able to reproduce your issue on both 5.2.6 and 5.4.0. If you do not have too many logs on FAZ, I suggest clear hcache and re-run the report. The CLI command is: dia sql remove hcache

     

    Regards,

    hz

    Terrence_M
    New Member
    April 22, 2016

    hz,

     

    Not sure if this will make a dif the analyzer in question is VFaz 5.2.4. I've gone ahead and done the remove hcache and still returns blank. I did test this on our demo 1000D on 5.4.0 and it works. So not sure why the 5.2.4 is being a pita.

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!