Adding a bandwidth column - breach of 3 column rule ?

[fran1942]

Hello, I have a report that shows browsetime for top Shopping catdesc users (attached image).

I would also like to add a bandwidth column. Is someone able to show me how to do that ? I am stuck !

Or would that then be a breach of the maximum limit of 3 columns in a drilldown dataset ?

select user_src, domain, ebtr_value(ebtr_agg_flat(browsetime), null, $timespan) as browsetime from ###(select user_src, domain, ebtr_agg_flat(browsetime) as browsetime from (select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src, coalesce(nullifna(hostname), ipstr(`dstip`)) as domain, ebtr_agg_flat($browse_time) as browsetime from $log where $filter and $browse_time is not null and (catdesc = 'Shopping') group by user_src, domain) t group by user_src, domain order by ebtr_value(ebtr_agg_flat(browsetime), null, null) desc)### t group by user_src, domain order by browsetime desc

[fran1942]

Hello, yes I have confirmed with Fortinet that there is a 3 column limit for drilldown datasets.

This post is therefore self-answered.