This may work. Try it, but be aware that the transaction command can use a lot of memory and be impractical for very large data sets. yoursearchhere | transaction ip mac startswith="DOT11-6-ASSOC:" endswith="DOT11-6-DISASSOC" | stats count as NumberOfSessions dc(mac) as NumofPatrons avg(duration) as AvgSessionTime | fieldformat AvgSessionTime=tostring(AvgSessionTime,"duration") or, if you don't want the summary statistics yoursearchhere | transaction ip mac startswith="DOT11-6-ASSOC:" endswith="DOT11-6-DISASSOC" | eval SessionTime = tostring(duration,"duration") | eval StartTime=strftime(_time,"%x %X") | table mac StartTime SessionTime These searches assume that you have extracted the ip and mac fields. If you have not, do this yoursearchhere | rex "\d{2}:\d{2}:\d{2}\s+(?<ip>\d+\.d+\.d+\.d+)\s.*?Station\s+(?<mac>.{4}\..{4}\..{4})" ...followed by the rest of the commands ... HTH ... View more