Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
wongwmr22
New Contributor

I have problem in reporting totol bandwidth over 1Gb by adjusting dataset

Hi,

 

I use the following sql at the dateset and add "having ....>1000000000" but it drop some record after I add it to the chart then report, but when I test it in the dataset view its query normally.

 

sql as below:

select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and (logflag&1>0) group by user_src having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>1000000000 order by bandwidth desc

 

After I change "having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0" to "having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>1000000000"

 

the bandwidth and data sent and data received changed (sometime cut half) on same user.

 

Raymond

0 REPLIES 0
Labels
Top Kudoed Authors