Hello everyone,
Currently, I have created a custom report to obtain the activity of the top 10 destination IPs with the highest consumption over the last 30 days. When I generate the job_id through the following URL, it returns a job ID:
https://1.1.1.1/api/?key=sahdsdksjhrjhashdjshdxsiidssaa=&type=report&async=yes&reporttype=custom&reportname=Actividad_IPs_Destination
The response I get is:
<response status="success">
<result>
<msg>
<line>Report job enqueued with jobid 50922</line>
</msg>
<job>50922</job>
</result>
</response>
Next, to retrieve the information for the job_id, I run the following in my browser:
https://1.1.1.1/api/?key= sahdsdksjhrjhashdjshdxsiidssaa =&type=report&reporttype=custom&reportname= Actividad_IPs_Destination&action=get&job-id=50922
However, instead of showing the destination IP, it shows the network:
<response status="success">
<result>
<job>
<reportjob/>
<tenq>17:59:16</tenq>
<tdeq>17:59:16</tdeq>
<tlast>17:59:28</tlast>
<status>FIN</status>
<percent>100.000000</percent>
<recordcnt>5</recordcnt>
<ndev>1</ndev>
<nskip>0</nskip>
<nreq>1</nreq>
<nresp>1</nresp>
<nproc>1</nproc>
<eruntime>0</eruntime>
<id>50922</id>
</job>
<report name="Actividad_IPs_Destination" logtype="trsum" start="2025/01/08 17:59:16" start-epoch="1736369956" end="2025/02/07 17:59:15" end-epoch="1738961955" generated-at="2025/02/07 18:04:12" generated-at-epoch="1738962252" range="Wednesday, January 08, 2025">
<entry>
<dst>192.168.1.0/24</dst>
<dst_mac/>
<bytes>18154399782676</bytes>
<sessions>4985490</sessions>
<nthreats>0</nthreats>
<ncontent>0</ncontent>
<nurlcount>4883655</nurlcount>
<nunique-of-apps>4</nunique-of-apps>
</entry>
<entry>
<dst>192.168.1.0/24</dst>
<dst_mac/>
<bytes>16728970908595</bytes>
<sessions>4548543</sessions>
<nthreats>0</nthreats>
<ncontent>0</ncontent>
<nurlcount>4449153</nurlcount>
<nunique-of-apps>4</nunique-of-apps>
</entry>
<entry>
<dst>200.48.10.0/24</dst>
<dst_mac/>
<bytes>16463783553950</bytes>
<sessions>4203737</sessions>
<nthreats>0</nthreats>
<ncontent>0</ncontent>
<nurlcount>4117559</nurlcount>
<nunique-of-apps>4</nunique-of-apps>
</entry>
<entry>
However, when I download the report directly from the Panorama console in XML format, it shows the actual destination IP and not the network:
<response status="success">
<result>
<job>
<reportjob/>
<tenq>17:59:16</tenq>
<tdeq>17:59:16</tdeq>
<tlast>17:59:28</tlast>
<status>FIN</status>
<percent>100.000000</percent>
<recordcnt>5</recordcnt>
<ndev>1</ndev>
<nskip>0</nskip>
<nreq>1</nreq>
<nresp>1</nresp>
<nproc>1</nproc>
<eruntime>0</eruntime>
<id>50922</id>
</job>
<report name="Actividad_IPs_Destination" logtype="trsum" start="2025/01/08 17:59:16" start-epoch="1736369956" end="2025/02/07 17:59:15" end-epoch="1738961955" generated-at="2025/02/07 18:04:12" generated-at-epoch="1738962252" range="Wednesday, January 08, 2025">
<entry>
<dst>192.168.1.220</dst>
<dst_mac/>
<bytes>18154399782676</bytes>
<sessions>4985490</sessions>
<nthreats>0</nthreats>
<ncontent>0</ncontent>
<nurlcount>4883655</nurlcount>
<nunique-of-apps>4</nunique-of-apps>
</entry>
<entry>
<dst>192.168.1.40</dst>
<dst_mac/>
<bytes>16728970908595</bytes>
<sessions>4548543</sessions>
<nthreats>0</nthreats>
<ncontent>0</ncontent>
<nurlcount>4449153</nurlcount>
<nunique-of-apps>4</nunique-of-apps>
</entry>
<entry>
<dst>200.48.10.20</dst>
<dst_mac/>
<bytes>16463783553950</bytes>
<sessions>4203737</sessions>
<nthreats>0</nthreats>
<ncontent>0</ncontent>
<nurlcount>4117559</nurlcount>
<nunique-of-apps>4</nunique-of-apps>
</entry>
Has anyone in this community encountered a similar issue and found a solution? I’m automating some manual reports using Python to execute them at a predefined time.
