Need sub-chart dataset name

[Zilitonas]

Hi guys,

I need help with chart "Top 5 Users by Bandwidth". As we all know, this chart has dataset "utm-drilldown-Top-Users-By-Bandwidth" and a sub charts, which is called: Application Summary, Threat Summary, Traffic Summary, Web Summary. If I applies a filter on the report "Top 5 Users by Bandwidth" (example filter: dstintf=wan1), this filter does not work on a sub charters datasets. Filter only works on  dataset ""utm-drilldown-Top-Users-By-Bandwidth".

My question is: maybe someone you know the subcharts datasets names? 

If I knew the datasets name, then I'll try to find it in FortiAnalyzer configuration file and then I try to change dataset.

[awasfi_FTNT]

Hello,

You may use the following command to figure out the sub-charts/datasets used by this chart:

# execute sql-report run root 10005

Where "root" is the default ADOM, 10005 is "User Report" ID.

You can use "?" to list available reports:

# execute sql-report run root ?

Regards,

[hzhao_FTNT]

Hi there, the filter issue you mentioned has been fixed in 5.2.7. For this special designed drilldown chart, even you know the dataset name, you still can not modify the sub chart setting. Please upgrade your FAZ. 

Regards,

hz

[Zilitonas]

Hi,

Awasfi_FTNT, thank you very much for the command. I have found the desired DataSet.

Best Regards

[Zilitonas]

Hi again guys,

I have found the desired DataSet names in the FAZ backup file. They called: "utm-drilldown-Top-User-Destination" and "utm-drilldown-Traffic-Summary", they are in the directory: var\dm\syntax\ncmdb\.... and var\pm2\... 

Then I backup file extract with tar, change dataset config, save and restore to FAZ, but nothing has changed, datasets codes remain the same :(

If I then download backup file from FAZ and I look at the configuration, it is default config.

Is it possible to change the default datasets?

Possible to remove the protection from a datasets?

Best Regards