How does FortiAnalyzer retrieve specific log data from the database?

FortiAnalyzer uses a SQL-like query language to build datasets for reports and analytics. The core command used to query the log database and retrieve specific data is the SELECT statement. This statement allows administrators to specify which columns (fields) to retrieve, from which log table, and apply filters to narrow down the results, effectively retrieving the desired log data.

A. SQL FROM statement: The FROM clause is a mandatory part of a SELECT statement that specifies the source table, but it is not the command that performs the data retrieval action itself.

B. SQL GET statement: GET is not a standard SQL command for querying or retrieving data from a database.

D. SQL EXTRACT statement: EXTRACT is a SQL function used to pull a specific part from a date or time value (e.g., the year from a timestamp), not for general data retrieval.

1. FortiAnalyzer 7.4.1 Administration Guide

Page 228

"Reports > Datasets > Creating datasets": The guide explicitly states

"FortiAnalyzer datasets are used to query the log data on the FortiAnalyzer unit. The queries are written in a SQL-like language

using the SELECT statement..." It provides numerous examples where every query begins with SELECT

such as SELECT user

sum(sentbyte) AS sent

sum(rcvdbyte) AS rcvd FROM $log WHERE $filter GROUP BY user ORDER BY sent DESC. This directly confirms that SELECT is the statement used for retrieval.