HI Vatsa, Thank you for the time you spent with my problem. I am unable to figure out the regex. I am trying another scenario now where I calculate the Scree Locked time minus the screen Unlock time so I can get total duration of screen was locked on a windows pc. Here are the logs and what I managed to put together so far. Information,Audit Success,11.2.2022 г. 13:51:11,Microsoft-Windows-Security-Auditing,4800,Other Logon/Logoff Events,Security,"The workstation was locked.   Information,Audit Success,11.2.2022 г. 13:51:19,Microsoft-Windows-Security-Auditing,4801,Other Logon/Logoff Events,Security,"The workstation was unlocked.   index="........." | rename EXTRA_FIELD_8 as message | rename "Event ID" as eventid | rename "Date and Time" as DT | eval message=if((eventid=4800),"LOCKED", "UNLOCKED") | table message,DT I would appreciate any help with substracting Locked time from Unlock time and creating a Mon-Fri timechart that shows duration of a pc on screenlock 🙂 ... View more