Hi there, if you know the user name, please apply a user filter in Report->Advanced Settings->Add Filter. BTW, if you group by itime, you won't see aggreted bandwidth/browsetime during report period, suggest to remove it or use macro like $DAY_OF_MONTH, $DAY_OF_WEEK, $HOUR_OF_DAY... Please also add $filter into your dataset, report filter won't work without it.
HZ: I used the "User" filter in Advanced settings and it did not work. NOTE: I've used the "User" filter for other reports and it worked appropriately. My thought is that the DSTIP range is overriding the filter applied under Advanced Settings.
I have tested below dataset with "user" filter applied, it looks OK to me. Both user and dstip filter can be applied
select `user` as usr, srcip, dstip,
sum(coalesce(sentbyte,0)+coalesce(rcvdbyte,0)) AS Bandwidth,
sum($browse_time) as browsetime
where $filter and
dstip between '220.127.116.11' and '18.104.22.168'
group by usr, dstip, srcip
order by usr asc
[<font] `user`, srcip,
[<font]sum(coalesce(sentbyte,0)+coalesce(rcvdbyte,0)) AS Bandwidth,
[<font]sum($browse_time) as browsetime,
[<font]from_itime(itime) as date_time
[<font]where $filter and
[<font]dstip between '22.214.171.124' and '126.96.36.199'
[<font]group by `user`, date_time, dstip, srcip, hostname
[<font]order by user asc, date_time asc
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.