Fortiview Custom Report

[g3rman]

In FortiView the "Top Destinations" report lists "Destination - Application - Sessions - Bandwidth".

I'm trying to recreate that same view in a report. Does anyone have this already?

[hzhao_FTNT · Accepted solution]

You can try our predefined chart "Top 30 Applications by Bandwidth and Sessions" and add a hostname or dstip filter when you run report.

If u want to create a custom one, try below dataset:

select coalesce(nullifna(root_domain(hostname)), ipstr(`dstip`)) as domain, app, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and nullifna(app) is not null and logid_to_int(logid) not in (4, 7, 14) group by app, domain having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc

hz