index=main host=10.247.82.1 user=* | rex field=duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username, date_month, date_mday | bin _time span=1d
Results:
date month total duration
april 24 2657
... View more