Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Ian_Harrison
New Contributor

Custom report to list defined keywords that users have searched for

Hi

 

I need some help in defining a report that I can define a number of keywords in (or pass to) and then to list those keywords and which users used them in searches.  I can run a report to list the top x number of keywords and this works fine so I know they are been logged ok.

 

Thanks for any help.

 

Ian

Web: www.activatelearning.ac.uk Twitter: twitter.com/activate_learn Facebook: facebook.com/Activate-Learning
2 REPLIES 2
Ian_Harrison
New Contributor

Hi

 

So I have tried the following code, has anyone got anything better:

 

select from_itime(itime) as timestamp, keyword, srcip, coalesce( nullifna(`user`), ipstr(`srcip`) ) as user_src, count(*) as requests from $log where $filter and keyword = 'google' or keyword = 'london' group by keyword, timestamp, srcip, user_src order by timestamp

Web: www.activatelearning.ac.uk Twitter: twitter.com/activate_learn Facebook: facebook.com/Activate-Learning
hzhao_FTNT

Hi there, your dataset looks OK. But if you need count(*), please removed timestamp in your query.

 

hz

Labels
Top Kudoed Authors