I tried updating it to this but it still doesnt work | stats count by Location Action Type a_rid _time
| stats list(Action) as action, list(Type) as type, list(_time) as time by Location a_rid Action
| eval total=mvzip(time, type)
| mvexpand total
| makemv total delim=","
| eval value1=mvindex(total, 0)
| eval value2=mvindex(total, 1)
| stats min(time) as begins, max(time) as ends by Location a_rid
| eval start=strptime(begins,"%H:%M:%S")
| eval finish=strptime(ends,"%H:%M:%S")
| convert timeformat="%H:%M:%S" ctime(begins) AS start
| convert timeformat="%H:%M:%S" ctime(ends) AS finish
| eval duration=finish-start
... View more