Help needed for easy report needed (Report which users are hitting a policy)

[Mattias]

Hi there,

I need a very simple report but I have no idea how to do it.

I have a policy (policyid 2) on a Fortigate and I want to see which users are hitting/using the policy. That's it. It should look like this:

Policy         User

2               user1

2               user2

2               user3

and so on.

A user should be only displayed once.

Could you please help me?

Thanks and best regards

Mattias

[hzhao_FTNT]

Please try below dataset, log type traffic:

select policyid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src from $log where $filter and policyid='2' group by policyid, user_src

regards,

hz