Hi  I am working in a system which looks for DFS (Dynamic Frequency Selection) channels. The search starts with the following event: CAC_STARTED. If if find a DFS channel then the search ends with CAC_COMPLETED and stays in DFS channel. If there is a radar detected, then the search ends with CAC_STOPPED and the system switches to non-DFS channel. Later the system again searches for DFS channel with CAC_STARTED and the patter follows.  I am trying to calculate the time spent on DFS and non-channels in a day.  Can someone please help me with the queries. I tried the following:  index=* mac="0cf9c0fef6fe" ("ACI_CAC_COMPLETED") | sort _time | stats max(_time) as maxtime min(_time) as mintime | eval maxt=strftime(maxtime,"%d:%H:%M:%S") | eval mint=strftime(mintime,"%d:%H:%M:%S") This gives me the total time spend on DFS channel BUT only if the system has never switched to non-DFS channel, ie., the ACI_CAC_STOPPED event never appeared in the whole span. How do I check if there was a ACI_CAC_STOPPED event in between an calculate the dfs and non-dfs time spent durations? Please advise. ... View more