Like this: |makeresults | eval _raw="CN Start_Time SourceIP End_Time Dura(minutes) Thor 03/16/20-12:20:46 xxx.xxx.xx.xxx 03/16/20-12:59:02 38 Thor 03/16/20-12:58:57 xxx.xxx.xx.xxx 03/16/20-13:08:14 9 Thor 03/16/20-13:08:21 xxx.xxx.xx.xxx 03/16/20-13:10:11 2 Thor 03/16/20-13:10:18 xxx.xxx.xx.xxx 03/16/20-13:12:02 2 Thor 03/16/20-13:12:05 xxx.xxx.xx.xxx 03/16/20-13:17:40 6 Thor 03/16/20-13:17:46 xxx.xxx.xx.xxx 03/16/20-13:21:03 3 Thor 03/16/20-13:21:12 xxx.xxx.xx.xxx 03/16/20-14:12:57 52" | multikv forceheader=1 | rename Dura_minutes_ AS "Dura(minutes)" | rename COMMENT AS "everything above generates sample event data; everything below is your solution" | rename "Dura(minutes)" AS Dura_minutes_ | foreach *Time [ eval <<FIELD>> = strptime(<<FIELD>>, "%m/%d/%y-%H:%M:%S") ] | stats min(Start_Time) AS Start_Time max(End_Time) AS End_Time sum(Dura_minutes_) AS "Dura(minutes)" BY CN | fieldformat Start_Time = strftime(Start_Time, "%m/%d/%y-%H:%M:%S") | fieldformat End_Time = strftime(End_Time, "%m/%d/%y-%H:%M:%S") ... View more