index=myindex "event=login" OR "event=logout" | transaction username startswith="event=login" endswith="event=logout" keepevicted=true | eval start_event=mvindex(event,0) | eval end_event=mvindex(event,1) | eval start_time=mvindex(when,0) | eval end_time=mvindex(when,1) | eval end_time=if(isnull(end_time), now(), end_time) | eval range = mvrange(start_time, end_time, 60) | mvexpand range | eval _time = range | timechart span=15m dc(username) AS concurrent_users by username  So the problem is that users that logged in prior to my search window but logged out continue to show up as constantly connectioned,  I tried to do something with if the only event was logout to make the start_time=earliest but that doesn't like that.  I have the end_time equal to now() if there is no end_time. "event" is login or logout, "when" is the epoch time of the event, and username is what it sounds like. So I would like to be able to handle the case when someone logged in before my search window(no login event), or the case when someone is currently logged in (no logout event); and obviously the case where someone has both a login and logout event, the only case I won't be able to handle is the if someone logged in before my time window and are still logged in, but the system has a 24hour timeout so I think we should be good if I have a window bigger than 24hours. Attached is a screenshot of the issue both users logged out on Friday, but continue to show logged in all week.  Thank you, Brian ... View more