the required fields devid, srcip, dstip, user are extracted or transformed from the fortigate log by the add-on, so if your fortigate FOS version is 5.0 and later, you will be able to get those fields from fortigate logs.
can you share the query string for the alert your created? and the matching result?
what problem do you have with the fortigate alert action? No firewall policy is created on fortigate?
if you could share $SPLUNK_HOME/var/logs/splunk/FortiGateActions_modalert.log, it would be most helpful.
... View more