Fortinet FortiGate App for Splunk: Why are there no login or failed login attempt events in the authentication dashboard?

[brandonf]

Good day

We are only seeing user logoff events in the Authentication dashboard - there are no logons or failed login attempts etc.
Should these be under type=event?

We currently use Active Directory for authentication.

regards
B

[jerryzhao]

They should be under type=event and subtype=user
can you do a search in research and report app with query string fgt_auth? and see if there is any result about logon