FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
FortiZiq
Staff
Staff
Article Id 391352
Description This article describes the troubleshooting steps when certain/specific reports cannot be generated, either via schedule, manual generation, or CLI.
Scope FortiAnalyzer.
Solution

The following issue may happen in FortiAnalyzer, where only certain reports cannot be generated:

 

reportfail.png

 

This might be due to unsupported SQL functions/methods being used in the dataset. In the example below, the type cast using double colon (::) is not supported. The validation will also show an error:

 

datasetfail.png

 

The custom dataset will need to be revised to exclude the unsupported functions or use an equivalent function/method that is supported. In the example, the double colon can be changed to the function CAST(), which can also be used to perform a type cast:

 

datasetsuccess.png

 

Once the validation shows that there are no issues found, the report should be able to be generated:

 

reportsuccess.png

 

Related articles:

Troubleshooting Tip: Report Generation Issues on FortiAnalyzer
Troubleshooting Tip: Dataset query error due to database changes in FortiAnalyzer v7.6
Contributors