listing the starting and ending time for a field value

[smolcj]

hi,
my log contains several users and i have to create a text report or a table listing the starting and ending time of the activities of the user, it will be in sequential manner(there will be continuous activities from one user and once he goes idle the other user will start ans so on).it means when the user "started" his activities and when he "logged out". i will not get a logged out or similar message in my logs so that i can filter through it. But how to list the time according to the field value i mean "users".
Thanks for your valuable time.

[Ayn]

Assuming you have a field called "user" in your events that identifies which user the event is referring to:

... | stats earliest(_time),latest(_time) by user

[smolcj]

Thanks Ayn, it really worked. shall i ask one more doubt? if my user is logging out and later he is logging in again, then i will get the second logout time as the logout time. how can i include both the sesssion? is there any query which helps it?
THANK YOU