@eddieddieddie I think your streamstats logic is wrong in your example I believe you should bring forward the session_end from the previous row and then check if the start time is before the previous end. Here it then uses a second streamstats to find the earliest session start and resets before an overlap. | streamstats current=false window=1 last(session_end) as last_end_time by Username
| eval overlap=if(session_start<last_end_time,"yes","no")
| streamstats min(session_start) as first_start max(session_end) as last_end by Username reset_before="overlap=\"no\""
| stats max(session_end) as session_end by Username first_start
| eval duration=session_end-first_start
| convert ctime(session_end) ctime(first_start) This example below has a single user with 5 events, 2 sessions and the first two overlap and the last 3 overlap. Hopefully this demonstrates something that will work for you | makeresults
| eval session_start=strptime("2022-12-11 14:25", "%F %H:%M")
| eval session_end =strptime("2022-12-11 14:55", "%F %H:%M")
| append [
| makeresults
| eval session_start=strptime("2022-12-11 14:35", "%F %H:%M")
| eval session_end =strptime("2022-12-11 15:10", "%F %H:%M")
]
| append [
| makeresults
| eval session_start=strptime("2022-12-11 15:35", "%F %H:%M")
| eval session_end =strptime("2022-12-11 16:10", "%F %H:%M")
]
| append [
| makeresults
| eval session_start=strptime("2022-12-11 15:45", "%F %H:%M")
| eval session_end =strptime("2022-12-11 16:30", "%F %H:%M")
]
| append [
| makeresults
| eval session_start=strptime("2022-12-11 15:45", "%F %H:%M")
| eval session_end =strptime("2022-12-11 17:10", "%F %H:%M")
]
| eval Username="eddieddieddie"
| eval SessionID="12345"
| fields - _time
| sort 0 session_start
| streamstats current=false window=1 last(session_end) as last_end_time by Username
| eval overlap=if(session_start<last_end_time,"yes","no")
| streamstats min(session_start) as first_start max(session_end) as last_end by Username reset_before="overlap=\"no\""
| stats max(session_end) as session_end by Username first_start
| eval duration=session_end-first_start
| convert ctime(session_end) ctime(first_start)
... View more