Sorry I had a lot of another work...
You get the results for every few seconds because it is something like a stream, after a few seconds you download the next portion of the video file.
You need to do a compromise let's say you will report these data for every hour.
Could you try this dataset:
SELECT time||':00' AS htime,
SUM(filesize) AS filesize
SELECT TO_CHAR(FROM_ITIME(`itime`), 'YYYY-MM-DD HH24') AS time,
COALESCE(NULLIFNA(`user`), NULLIFNA(`unauthuser`), IPSTR(`srcip`)) AS user_src,
SUM(`filesize`) AS filesize
FROM $log WHERE $filter
AND NULLIFNA(`filename`) IS NOT NULL
GROUP BY time, filename, user_src
ORDER BY time ASC
GROUP BY htime, user_src, t.filename
ORDER BY htime ASC
It was created on FAZ version 5.6.3, the FortiGate logging to FAZ is on version 5.6.4.
You will get results like: