Support Center

No data in report. Why do my reports come back blank?

Last Updated: Jun 14, 2019 08:55AM PDT
Sometimes you may see this message after generating a report:

This message can mean one of two things:
  1. The filter you used when generating the report did not match any data.
  2. There is no data in the date range you chose to report on.
It is quite simple to investigate whether data was available in the date range you selected (number 2). Go to Settings | Data Storage and look at the chart showing the dates available to report on. Is there data for the dates you chose to report on?

If not, the data has either been purged by the data retention policy (check Settings | Data Storage | Settings), or there was a data import issue on the dates you chose to report on. Perhaps the Fastvue Reporter service was not running, or your Firewall was not sending syslog data during those dates. 

Troubleshooting Filters

If there is data shown in the Settings | Data Storage chart, then the blank report is due to an issue with the filter you specified.
 

Reporting on Users without Authentication

The most common issue we see is when reporting on users. Even though you can select a User from a picklist in Fastvue Reporter, the report will come back blank if your FortiGate has not logged any authenticated traffic for that user.

For example, when running a User Overview Report, Fastvue Reporter provides a picklist of users to report on. This list of users is built using the information imported from Active Directory. In order to find the traffic that matches the selected user, FortiGate needs to first authenticate the traffic to include the authenticated username in the syslog data it sends to Fastvue Reporter.

Without authentication, the report will come back blank. Instead, try filtering reports by IP addresses or hostnames. For more information see Understanding How Fastvue Reporter shows Users (or hostnames or IP addresses)
 

Reporting on Departments, Offices or Security Groups without Authentication

Filtering reports by Departments, Offices of Security Groups also requires FortiGate to authenticate users.

Without authentication, Fastvue Reporter cannot match the log data to user objects in Active Directory, and therefore cannot filter data by Departments, Offices or Security Groups. Instead, try filtering reports by Subnets using a filter such as:

Subnet Filter
 

Beware of the 'AND' between Filter Criteria Rows

If you have multiple filter criteria rows, be aware that each row is evaluated with an 'AND'.

For example, this filter will never match any data as a user cannot be both John and Sarah (multiple personality disorders aside):


Incorrect AND filter

Instead, you should use this.

Correct OR Filter

Each value in the same row is evaluated with an 'OR'.
 

String Matching Issues

When filtering Reports, many fields provide a picklist to choose from such as Productivity, Actions, and Categories. But for other fields, you need to type the value you want to filter by.

Some fields in Fastvue Reporter (such as the Site fields - see below) expect a specific string or value, and if you don't enter the exact value required, the report will come back blank.

When filtering by any of the Site fields, read the hint provided in the Value edit box for the part of the URL each field expects. For example:

This filter will never match:
Site 'Equal to' youtube.com

as 'Site' expects a sub-domain such as www.youtube.com.

Instead, you should use:
Site Domain 'Equal to' youtube.com

Or alternatively, use the 'Contains', operator:
Site 'Contains' youtube.com

Also, be careful of the dreaded typo:
Site Domain 'Equal to' yuotube.com

For more information on reporting on sites, please see Using Filters to Report on Websites with Fastvue Reporter.

If all of the above checks out, and you're still receiving blank reports, please get in touch and let us know the filter you are using (screenshots help!).

Contact Us

  • Post a Public Question
  • Email Us
  • Chat with us

    Call Us @ 888.885.6711
support@fastvue.co
http://assets2.desk.com/
false
desk
Loading
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
about
false
Invalid characters found
/customer/en/portal/articles/autocomplete