You could give this a try. index=azure Operation=UserLoggedIn user!=Unknown| | iplocation ClientIP | eval Time=strftime(_time, "%m-%d-%y %H:%M:%S") | stats Values(src_ip), values(Country) as Country, latest(_time) AS earlyTime, earliest(_time) AS lateTime, dc(Country) as count_country, Values(Time) count by user | eval elapsedSeconds = tostring(lateTime - earlyTime, "duration") | where count_country>1 We add in the two fields you need (earliest and latest time) into the stats, then do a little math and format the results. Give that a try, and let us know how it works! -Rich ... View more