Hello @to4kawa, I decided to do it just by calculating the total in seconds. index=vpn eventtype=cisco_vpn_end Username=* Group="*" | fillnull value=0 duration_day | multikv noheader=t | eval total_duration=duration_day * (86400) + duration_hour * 60 * 60 + duration_minute * 60 + duration_second | stats sum(total_duration) as Total_duration by Username Group | eventstats sum(total_duration) as Total_duration by Username duration_day duration_hour duration_minute duration_second | sort - Total_duration So I did another research with more details of the navigation, making a statistic by the time and user. index=vpn (eventtype=cisco_vpn_start OR eventtype=cisco_vpn_end) user=* | transaction user endswith="duration:" keepevicted=true | fillnull value=0 duration_day | eval full_duration = duration_day."d-" .duration_hour.":" .duration_minute.":".duration_second | eval bytesMB=round(((bytes/1024)/1024),2), bytes_inMB=round(((bytes_in/1024)/1024),2), bytes_outMB=round(((bytes_out/1024)/1024),2) | eval Start_time=strftime(_time,"%Y/%m/%d %H:%M:%S"), End_time=(strftime(_time + duration,"%Y/%m/%d %H:%M:%S")), Total_time=if(isnull(full_duration), Start_time." --> current session",Start_time." --> ".End_time) | mvexpand src | iplocation src | eval LocationIP=City.", ".Country | stats values(Total_time) as "Session Time" values(src) as "PublicIP" values(LocationIP) as LocationIP values(IP) as "Assigned IP" values(reason) as "Termination Reason" values(bytesMB) as bytesMB values(bytes_inMB) as bytes_inMB values(bytes_outMB) as bytes_outMB values(full_duration) as Duration by _time, user | sort -_time | search PublicIP=* Thank you so much for your help, it was awesome. James \o/
... View more