Report shows no results

[koelschman]

Hello, i made a custom dataset: select srcip, dstip, proto, dstport, service, count(Srcip) from $log group by srcip, dstip, proto, dstport, service order by srcip when i test it, it shows the recommended entries. But after using the dataset in a chart, or macro, no entries are shown. Regards.

[AtiT]

Hi, What is the FAZ version? I think the alias is missing at count(Srcip). Try it this way: select srcip, dstip, proto, dstport, service, count(Srcip) as totalnum from $log group by srcip, dstip, proto, dstport, service order by srcip You will need to check the chart and put the totalnum alias into the correct column where you want it. It is working on my side with FAZ-VM OS v5.0.7

[koelschman]

Hi, we´re using v5.2.0-build0618 140826 as VM Appliance. When editing the sql statement and testing it, it works fine with the expected output. But in the report in the chart or macro i tested, no output occurs. " No matching log data" There aren´t any filters set

[hzhao_FTNT]

Hi, I have tested the query on 5.2.0B618, it is working fine. Please create a new chart based the updated query, then insert the chart into template. By the way, in order to make filter working, you should add $filter into query. select srcip, dstip, proto, dstport, service, count(Srcip) as totalnum from $log where $filter group by srcip, dstip, proto, dstport, service order by srcip