| transaction uno, programId, devicetype maxpause=15s | eval s_time=_time | eval e_time=_time+duration | eval watch_sec = e_time - s_time | eval _time=s_time | eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S") | eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S") | transaction uno, programId, devicetype | eval s_time=_time | eval e_time=_time+duration | eval watch_sec = e_time - s_time | eval _time=s_time | eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S") | eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S") When I use maxpause, events(00:00:00~00:06:50) are dropped. I've changed it for 20 seconds, and then events(00:00:00~00:09:00) are dropped. If there's any other way not to drop events, I want you to let me know. Thx. edit) I want to find time to use the program by user. There are about 400 million events a day, so I'm working on reducing these to about a million. I edited spl. Thx. edit) My goal is before) 00:00:00 ~ 00:59:57 01:00:03 ~ 01:59:58 02:00:02 ~ 02:30:00 04:30:00 ~ 04:59:56 05:00:01 ~ 05:30:00 21:30:00 ~ 21:59:55 22:00:04 ~ 22:30:00 after) 00:00:00 ~ 02:30:00 04:30:00 ~ 05:30:00 21:30:00 ~ 22:30:00 ... View more