Like this: | makeresults | eval raw="Time=01,State=Online Time=02,State=Online Time=03,State=Offline Time=04,State=Offline Time=05,State=Offline Time=06,State=Online Time=07,State=Online Time=08,State=Offline Time=09,State=Offline Time=10,State=Online Time=11,State=Online" | makemv raw | mvexpand raw | rename raw AS _raw | kv | table Time State | reverse | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | streamstats count(eval(State=="Online")) AS sessionID | stats range(Time) AS duration BY sessionID ... View more