index=internal source=metrics.log group=per_index_thruput series!= | eval totalMB = round(kb/1024,2) | chart sum(totalMB) as total ... View more

This will work for what your trying to do. I converted the output duration to Hours:Minutes:Seconds source=*.log | xmlkv | stats first(Calling-Station-Id) as Calling-Station-Id, first(NAS-IP-Address) as NetworkDeviceName,first(User-Name) as User-Name,last(_time) as Starttime,first(_time) as Endtime,first(Acct-Session-Time) as DURATION by Acct-Session-Id | eval Starttime=strftime(Starttime,"%+") | eval Endtime=strftime(Endtime,"%+") | eval h=floor(DURATION/3600) | eval m=floor((DURATION-(h*3600))/60) | eval s=floor(DURATION-(h*3600)-(m*60)) | eval SessionDuration =h." Hours ".m." Minutes ".s." Seconds" | table User-Name Starttime Endtime SessionDuration Calling-Station-Id Works when I email the command. Does not work when i upload it to this post ... View more