no data returned for web filter violation report, but shows up in dataset

[Terrence_M]

I have built the following data set:

Log - Web Filter

select $calendar_time as time, srcip, catdesc, dstip, hostname from $log where $filter and action='blocked' group by time, srcip, catdesc, dstip, hostname order by time, srcip, catdesc, dstip, hostname

I built the chart, (see image) but when I go to run the report, it returns no data, even though I matched my report to my dataset testing - last 1 day - same firewall. Can anyone help me figure out what is causing the disconnect between the data set and report?

[hzhao_FTNT]

Hi there, I am not able to reproduce your issue on both 5.2.6 and 5.4.0. If you do not have too many logs on FAZ, I suggest clear hcache and re-run the report. The CLI command is: dia sql remove hcache

Regards,

hz

[Terrence_M]

hz,

Not sure if this will make a dif the analyzer in question is VFaz 5.2.4. I've gone ahead and done the remove hcache and still returns blank. I did test this on our demo 1000D on 5.4.0 and it works. So not sure why the 5.2.4 is being a pita.