- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- Re: Custom Report In R80.10 SmartEvent
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Custom Report In R80.10 SmartEvent
I am trying to create a customized version of the canned "Threat Prevention" report that focuses only on a specific network group. However, I'm getting an odd result as soon as I try to add the "Source" filter to the "Global" Filter.
To accomplish this, I cloned the supplied "Threat Prevention" report and gave it a different name. Then, I edited the report, and began to modify the Global Filters to drill down on the specific traffic I wanted. The first filter limits the traffic to a single Gateway Cluster based on "Origin". This filter works as expected. With just this filter applied, I still see data appearing in the report.
Then, I try to add on another filter setting "Source" equals "<name of network group object>". As soon as I add this filter and apply, all the data from the report vanishes and is replace with "Query Failed". Oddly, I am able to remove the "Source" filter and instead add "src:<name of network group object>" to the search filter bar at the top and that works. I see exactly the data I want filtered in the report.
However, we need this report scheduled and run daily. So, I don't want to have to rely on manual generation of this report. Does anyone have any idea what I might be doing wrong? We presently have this same report running in Smart Event NGSE using the same filter logic. Any assistance is greatly appreciated!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm inclined to think this is a bug and you should open a TAC case.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Indeed seems like a bug.
You can try to work around it, by selecting "custom filter" in the filter field, and use the same query syntax as you would in the search bar, i.e. src:<group name>
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the feedback. I'll give this a shot today and will likely open a case with TAC regardless.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Did you open a TAC case on this issue? And if, did you get a answer for this? I'm experiencing the same thing on NGSE edition, and I can't upgrade to R80.10 because of a MultiDomain log limitation.
When trying to add source field to any of my scheduled reports, no data is visible in the report. Data is visible in report preview, just not in the scheduled report
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The short answer is that I never did open a TAC case for the issue. I just used the workaround suggested by creating the custom filter.
