Introduction

Datasets define what data is extracted from the database and represented in a report’s chart. To create a report based on log messages in the local database, you can use either the predefined datasets or create your own custom dataset by querying the log message in the SQL database on the FortiAnalyzer.

While FortiAnalyzer provides pre-defined datasets that address the most common queries, you must understand Structured Query Language, also known as SQL, in order to effectively modify those datasets or create your own.

This document describes how to create and modify datasets in FortiAnalyzer. There is some information to explain SQL as it applies to the datasets, but it is not comprehensive.

FortiAnalyzer supports local ClickHouse SQL databases for the storage of log tables.