this worked for me, above solution helped me finish this off.
host=10.45.16.40 vpn/ "Session disconnected" | rex field=_raw "Duration:(? [^,]*)" | stats count by Username duration | rex field=duration "(? (\d+))h:(? (\d+))m:(? (\d+))s" | eval duration=Hour*3600 + Minute*60 + Second | stats sum(duration) as TotalDuration, sum(count) as SessionCount by Username
... View more