below example sums the duration when a machine is not running. ... | sort 0 - time | transaction startswith=running="0" endswith=running="1" keeporphans=f keepevicted=f | timechart span=1h sum(duration) first transaction of an hour: what happens to a transaction that rolls over into the hour? will it report against 13th hour because the transaction takes the first event's timestamp... like this one: thanks /c ... View more