How to calculate statistics for using PC

[ipoluda]

Hello!
I have a log that shows locking/unlocking PCs:

1710320306,u09,unlocked
1710320356,u09,locked
1710320360,u10,unlocked
1710320363,u10,locked
1710320369,u11,unlocked
1710320374,u11,locked
1710320379,u09,unlocked
1710320384,u09,locked
1710320389,u10,unlocked
1710321119,u10,locked
1710321126,u11,unlocked
1710322754,u11,locked
1710322760,u09,unlocked
1710324580,u09,locked
1710326550,u09,unlocked
1710328364,u09,locked

The first field - unix timestamp, second - user, third - action.

I need to get a statistics for PCs beeing unlocked by users. So it will the sum of seconds between unlocked-locked actions for each user. Please, help with search query

[isoutamo]

Hi

one way it use command transaction like

| makeresults format=csv data="_time,user,action
1710320306,u09,unlocked
1710320356,u09,locked
1710320360,u10,unlocked
1710320363,u10,locked
1710320369,u11,unlocked
1710320374,u11,locked
1710320379,u09,unlocked
1710320384,u09,locked
1710320389,u10,unlocked
1710321119,u10,locked
1710321126,u11,unlocked
1710322754,u11,locked
1710322760,u09,unlocked
1710324580,u09,locked
1710326550,u09,unlocked
1710328364,u09,locked"
| transaction startswith="action=unlocked" endswith="action=locked" user
| fieldformat duration=tostring(duration,"duration")

r. Ismo