Hello
After several hours testing the Fortianalyzer, I discovered how the dataset variables works:
It's used inside the variable $filter to replace the standard "where" clause generate by the fortianalyzer
Example:
Let's assume that I have the following dataset
select coalesce(nullifna(`user`),ipstr('srcip')) as user_src, root_domain(hostname) as website_domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where $filter group by user_src, website_domain
In the dataset, I created the following variable:
Variable: Group
Expression: lower(coalesce(nullifna(`user`),'empty'')))
Description: Users in Group
In the report that I use this dataset, we want to filter users from a specific Active Directory group. So we need to go to the "Advanced Settings" tab in the report and add a filter "Group (group)" Equal to "Group from AD". In this tab, we also need to check the option "LDAP Query" and set the LDAP Server.
The group "Group from AD" has the following users: john, david, peter
Now when I run the report, the Fortianalyzer replaces the $filter for:
select coalesce(nullifna(`user`),ipstr('srcip')) as user_src, root_domain(hostname) as website_domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where lower(coalesce(nullifna(`user`), 'empty')) in ('john','david','peter') group by user_src, website_domain
When we remove this variable, the query change to:
select coalesce(nullifna(`user`),ipstr('srcip')) as user_src, root_domain(hostname) as website_domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where (`user`) in ('john','david','peter') group by user_src, website_domain
In this example, my Active Directory store the username in lower case, but the fortianalyzer record the username in uppercase. Since the Postgres is case sensitive, I used the funcion "lower()" (from Postgres), to change the case from the value stored in the "user" field.
I am learning english, so I sorry about the grammar and other errors.
Thanks
Diego
, to add a variable, expression, and description information." What happens after that? Where is the variable used? How is it used? 
