Hello, I'm trying to get the duration of a transaction starting with "green" and stopping with "red" : The problem is that when i have data like this : time_001 Green time_002 Green time_003 Red time_004 Red time_005 Green time_006 Red time_007 Green time_008 Green time_009 Red The calculated duration is ko because of the duplicated events. This is my search query : host="Data_Host" "Connected" | rex ="Host (? . ) - (? .)" | transaction host startswith="*Green" endswith="Red" | stats sum(duration) as "uptime_duration" by ligneNum | convert timeformat="%d/%m/%y-%H:%M:%S" ctime(_time) AS "uptime_duration" | fieldformat uptime_duration=tostring(uptime_duration,"duration") I want my transactions to ignore the same redondant successif colors. the result should be something like : - time_001 Green - time_003 Red - time_005 Green - time_006 Red - time_007 Green - time_009 Red ... View more