How reports are populated

Reports are generated using logs and data stored in FortiAnalyzer. The type of logs used in the report are determined by datasets configured in FortiAnalyzer. These datasets are included in charts and macros, which are then added to reports alongside cover pages, images, and text to explain content for the user. When the report is run, the report is generated according to the available analytics logs and other relevant data in FortiAnalyzer. For more information about the logs used in reports, see Logs used for reports.

As demonstrated in the image above, reports rely on the following objects configured in FortiAnalyzer:

• Datasets: Determine the log type or data source tables to query from the database. For example, a dataset that queries FortiGate logs for botnet events.

• Charts: Reference a dataset to visualize queried data in a selected chart type, such as table, bar chart, pie chart, line chart, and more. For example, a line chart that displays number of botnet events over time.

• Macros: Reference a dataset to include queried data as text, bandwidth, counter, duration, or a percentage. For example, a macro that displays the total number of botnet events.

When a report is run, the generated report is populated using the charts and macros configured in the report. The data is included according to the datasets referenced in the charts and macros. You can use the Report Guidance feature to make sure the appropriate analytics logs are available for the report. This feature can help you to troubleshoot the report when it shows No Data, or to confirm you have the required logs after creating a custom report. For more information, see Report guidance.

There are many predefined datasets, charts, and macros used in predefined reports and report templates. If the data (logs) are available, you can generate these predefined reports. You can also clone and customize these predefined reports to alter them according to your unique needs. Alternatively, you can create reports from scratch using custom or predefined datasets, charts, and macros.

If you are using ADOMs, it is important to remember that each ADOM has its own reports, datasets, charts, and macros. For example, ADOMs can only support importing datasets that use the device types supported by that ADOM. Fabric ADOMs, however, can support all reports, regardless of the device type used in the datasets. Fabric ADOMs also support datasets that use the SIEM database (siemdb) to generate the report. Make sure you are in the correct ADOM before creating, editing, or generating a report. For more information, see How ADOMs affect reports.

When you generate a report, it can take days to assemble the required dataset and produce the report, depending on the required datasets. Instead of assembling datasets at the time of report generation, you can enable the auto-cache feature to assemble the report with the help of an "hcache". This can reduce report generation time significantly. For more information, see How auto-cache works.