Skip to main content
MaAtVA
Explorer
January 19, 2026
Question

Traffic data in PostgreSQL

Hello, i have a problem with dataset in Fortianalyzer. When i search traffic logs in Fortianalyzer under "LOG-VIEW" and "Traffic" i get different result than using Dataset Query in Report Definitions.

Are these queries based on different databases / data sources?

I run the following SQL in Dataset definition:

 

SELECT policyid, dstport, proto
FROM
$log-traffic as l
WHERE
$filter
AND policyid = '681'
group by policyid, dstport, proto
order by dstport

but this does not return the same ports like searching in Analyzer Log Traffic view when searching with

 

policyid="681"

 

I selected the device name in both search scenarios, in the drop down fields.

My question, from where does the difference result and should both query types return the same result? 

1 reply

illorenzoditorino
Explorer III
January 22, 2026

@MaAtVA I have seen that running the dataset does not always return correct results. Try using the dataset in chart and chart in a report and see if the results match with what you see in Log View - it should match :)

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT