FortiAnalyzer Custom Report

[mario_thenetworkguy]

Hello,

I am having an issue when generating a custom report on FortiAnalyzer.

I have created a custom dataset, added it to a chart and when I run it from here with real data, the table is showing successfully with data.

The issue is when I need to add this chart into a report and run it, I always get in the pdf report No matching log data for this report but when I run it directly from the chart tab it is working.

Below is the dataset created, appreciate your help why in the report it is not working

SELECT
srcip,
dstip,
action,
policyid,
user,
$calendar_time(itime) AS "time_stamp"
FROM $log
WHERE $filter
AND type = 'traffic'
AND subtype = 'forward'
AND policyid = 120
AND `group` = 'users'
ORDER BY eventtime DESC

[funkylicious]

hi,

in the report settings, are you defining the correct period of time and also selecting the correct device to run the sql select on logs ?

[mario_thenetworkguy]

Hello,

Thanks for ur reply, yes I have specified yesterday same as when I run it on the chart, and the device is selected to all (I only have one FGT connected to Analyzer)

[funkylicious]

ok, then it's really strange.

i created a really quick report / chart / dataset with the following select and worked just fine.

SELECT
srcip,
dstip,
action,
policyid,
user,
$calendar_time(itime) AS "time_stamp"
FROM $log
WHERE $filter
AND type = 'traffic'
AND subtype = 'forward'
ORDER BY eventtime DESC

L.E. maybe you have some kind of filter under the report settings. also, although you have only a FGT in the ADOM try selecting it.

[mario_thenetworkguy]

May I ask which FortiAnalyzer version you have ? I might now think as it is a bug or something; I don't have any filter added into the report setting and I tried selecting the device manually and same thing.

[funkylicious]

FAZ v7.2.9

[mario_thenetworkguy]

Mine is on 7.6.2

[filiaks1]

Strange ::ffff in the report for source/destination ip seems to match 839350 (Resolved Issues | FortiAnalyzer 7.2.2 | Fortinet Document Library ) . It should be resolved for the logs but maybe for the reports it is in 7.6.x as @mario_thenetworkguy  mentioned that his version is ok.