Fortiview Custom Report

g3rman · ‎04-07-2015

In FortiView the "Top Destinations" report lists "Destination - Application - Sessions - Bandwidth".

I'm trying to recreate that same view in a report. Does anyone have this already?

A Real World Fortinet Guide Configuration Examples & Frequently Asked Questions http://firewallguru.blogspot.com

hzhao_FTNT · ‎04-07-2015

You can try our predefined chart "Top 30 Applications by Bandwidth and Sessions" and add a hostname or dstip filter when you run report.

If u want to create a custom one, try below dataset:

select coalesce(nullifna(root_domain(hostname)), ipstr(`dstip`)) as domain, app, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and nullifna(app) is not null and logid_to_int(logid) not in (4, 7, 14) group by app, domain having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc

hz

View solution in original post

hzhao_FTNT · ‎04-07-2015

You can try our predefined chart "Top 30 Applications by Bandwidth and Sessions" and add a hostname or dstip filter when you run report.

If u want to create a custom one, try below dataset:

select coalesce(nullifna(root_domain(hostname)), ipstr(`dstip`)) as domain, app, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and nullifna(app) is not null and logid_to_int(logid) not in (4, 7, 14) group by app, domain having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc

hz