XML API Results for Custom Report Not Matching Data From Panorama GUI

[DerpingSherper]

Hello,

I am attempting to use the XML API for Panorama to capture the output of a report.  I am able to successfully pass the custom report name to the API and get some results, but the results are missing the Source User field outlined in the report definition in the Pano.

For example, the report definition (and the emailed report, when it worked) included the Source User, but that field is absent when I retrieve the results from the XML API.

Report Settings:

• Database: Device GlobalProtect Log
• Selected Columns:
  • Public IPv4
  • Generate Time
  • Portal/Gateway
  • Source User
  • Source Region
  • Error 
  • Count

Example XML API Results:

<public_ip>xxx.xxx.xxx.xxx</public_ip>
<resolved-public_ip>xxx.xxx.xxx.xxx</resolved-public_ip>
<time_generated>2025/08/05 21:23:30</time_generated>
<portal>vpn1</portal>
<srcregion>US</srcregion>
<error>Error Message</error>
<repeatcnt>1</repeatcnt>

Why isn't the XML API at parity with the data returned in the GUI/Scheduled Reports?

[sabina96clerk]

Hello,

The discrepancy between the data returned by the Panorama XML API and the data shown in the GUI or scheduled reports is a known issue for some log types and report definitions. The API may not be fully synchronized with all available fields, or there could be a specific syntax or parameter required to include the "Source User" field in the API call that isn't immediately obvious. It's also possible that the field name used in the API response is different from the human-readable name in the GUI. You may need to consult the specific Panorama XML API documentation for your version to see if there's an alternative way to request this field, or if it's a limitation of the API itself for that particular log database.

[DerpingSherper]

That is understandable, but from my searching online, there is zero documentation on what fields are accessible via the XML API when dealing with custom reports.