All the default web reports in WebSpy Vantage use the 'Username' field in the report templates. However, if your log data does not include usernames, you may like to change the report templates to use Source IP instead.
First you need to change the Template's schema to the schema of your log files (e.g SonicWall, Fortinet, Palo Alto Threat schema etc) rather than the 'All Web Schemas' schema.
To do this:
1. Go to the Reports tab and right-click the desired Report template
2. In the Schema dropdown, select the schema that matches your log data (only schemas for the data you have imported into a storage are shown)
3. Give the new report template an appropriate name and click OK.
Now you have a report template that can utilize all the extra fields in your log data - not just username, URLs and date/times. You can now change any 'user' node in the Report to use Source IP instead.
To do this:
1. Edit the new template
2. Double-click any 'User' node
3. On the 'General' page, double-click the 'Username' key column
4. Change the summary to Source Address (may also be called Client IP or Source IP - depending on your schema)
5. If you have created a Subnet Alias to transform IPs to usernames or hostnames, select the alias from the Alias drop down.
6. Click OK to save the key column.
7. Click OK to save the template node.
Repeat steps 2-7 for any other User nodes in the report. Then generate the report to see the results!