Perhaps if you shared some of your real events and results and your SPL, we might be able to advise you further. Vague descriptions of the issue and fake data means we can only offer solutions based what you have provided, and to that extent, the solution provided does work (but only with the fake data you provided)! ... View more

OK, ignoring the graphic since the dates are clearly wrong, try something like this |rex field=_raw "(?<message>OFF.*)|((?<sensor>Battery).*?(?<zone>\w+_ZONE))" |eval Device_ID=mvindex(split(source,"/"),5) |table Device_ID _time message sensor zone |where isnotnull(sensor) OR isnotnull(zone) OR isnotnull(message) |sort 0 Device_ID _time |streamstats current=f last(zone) as last_zone by Device_ID |eval def=case(zone="INTERVENTION_ZONE" AND last_zone="SAFE_ZONE","Changed",zone="SAFE_ZONE" AND last_zone="INTERVENTION_ZONE","Changed",zone="LOWER_THRESHOLD_ZONE" AND last_zone="UPPER_THRESHOLD_ZONE","Changed") |eval time_off=if(message=="OFF",_time,null()) |streamstats current=f last(time_off) as last_time_off by Device_ID | eval diff=if(def=="Changed",_time-last_time_off,null()) | chart sum(diff) by Device_ID, sensor ... View more