RESOLVED: Dataset OK, but report empty

[Frosty]

Hoping someone can give me a clue here. I am a newbie when it comes to designing reports in my FortiAnalyzer 100C. I have created a custom dataset, containing the following SQL query, which when I click the TEST link works just fine: -------------- begin SQL select id, ssid, (case `ap-status` when 0 then ' Unclassified' when 1 then ' Rogue!!!' when 2 then ' Accepted' when 3 then ' Suppressed' else ' others' end) as status, manuf, rssi, " radio-band" as radio, " security-mode" as security, " on-wire" , msg as message from $log where $filter and subtype= ' wireless' and action = ' rogue-ap-detected' and " ap-status" = 0 and rssi > 20 order by ssid -------------- end SQL This gives me a few records which I expect to see, so I also created a custom Chart which links to my dataset. I then created a custom Report and added my custom Chart. But when I run it, the report is empty. I' ve edited the Report Options and checked that its set to report on This Week (when I view This Week in the Dataset test I see records show up) ... but I keep getting No Data. The column headers in the chart display in the report are correct (I have set it to display 3 columns: id, ssid, status If I add another column to the chart, the column appears in the report ... but still no data.

[Frosty]

I' m going to upgrade the FA100C from v4.0 MR3 Patch 3 to Patch 5 tomorrow morning. There is at least one fix noted in the release notes for Patch 4 which looks like it will fix that case-sensitivity issue: 170686: When the alias in a query contains upper case letters, a syntax error will be reported and the report cannot be generated There may also be undocumented fixes in there I suppose. Plus I noticed this other item of interest to me in the fixes for Patch 5: 176521: The FortiAnalyzer fails to store generic syslog messages I really would like to use the FA100C as my syslog device, so that now looks like it might be possible.

[Frosty]

Now upgraded from 4.3.3 to 4.3.5 ... one fix ... one partial fix ... one not fixed ... and one new bug! (1) problem with double-quotes vs backticks working/not-working between Dataset and Report looks like it is fixed. (2) problem with case-sensitity on SQL query Alias names is partially fixed; you can now specify a Dataset with an UPPER CASE Alias name, but it will display as lower-case in the Chart definition and it will display as lower-case in the Report display itself; you can work around this by setting a colum heading name override in the Chart definition (by the way, this override was in the GUI of v4.3.3 but didn' t work properly; in v4.3.5 it does work properly, so that' s good) (3) inability to delete a Chart via the GUI even if it is not referenced in any Report is still broken in v4.3.5 however you can delete it via the CLI if necessary (4) NEW BUG: column headers and column data content misaligned in Chart/Dataset display in a Report (works fine when Testing the Dataset, just not in the Report itself).

[Frosty]

Issue #4 is being submitted to the developers as a bug. Issue #3 seems to be specific to (some?) Internet Explorer browsers only. I have been using IE v9.0.8112.16421 on Windows 7 64-bit. The greyed out Delete button isn' t a problem if using Firefox. EDIT: further testing on Issue #3 shows that if you create a Chart in IE the Delete button is greyed out, but if you logout, close IE, restart IE, login again, then the Delete button is accessible. Issue #2 turns out to be a " Feature" of the SQL engine ... if you put the Alias name in quotes it will respect it' s case-sensitivity; if you don' t put the Alias name in quotes it will force it to lower-case.