Hi All, I am using splunk to analyse squid logs and my goal is to identify how many minutes of the day a client ip or user is accessing the Internet (via squid) and report against it. I already have the following: sourcetype="squid_access" sq_user="username" | eval mb = round(sq_bytes/1024/1024) | timechart span=5m count sum(mb) This will report the number of events found in the log over a 5 min time span and the amount of MB downloaded. I would like to summarise this report further and calculate how many of the '5 minute timespans' have events. (The timespan could of course be 1 minute which may make the maths easier.). This will allow me to report how many minutes as user has been browsing. So the calculation would need to be a sum of all timespans that have events > 0. I am not necessarily interested in the number of events because the user is ether surfing or not... I may also choose a low number of events as a threshold to exclude open web pages that have some background activity, e.g. events > 5 or events > 10. Any idea if this is possible. Thanks ... View more