Updated - @ITWhisperer Sorry, I have missed one condition, here if hours count is grater then or equal 2 , then it is online else we wont count---- ------------------ | makeresults | eval _raw="HostName,LastConnected AAA,23/08/2021 11 AAA,23/08/2021 11 ABC,23/08/2021 12 AAA,23/08/2021 11 AAA,23/08/2021 12 AAA,23/08/2021 12 AAA,23/08/2021 13 AAA,23/08/2021 13 ABC,23/08/2021 11 AAA,23/08/2021 14 AAA,23/08/2021 21 AAA,24/08/2021 22 AAA,24/08/2021 22 ABC,23/08/2021 10 ABC,23/08/2021 10 AAA,23/08/2021 20 ABC,23/08/2021 13 ABC,23/08/2021 13 ABC,23/08/2021 14 ABC,23/08/2021 14 ABC,23/08/2021 15 ABC,23/08/2021 15 ABC,23/08/2021 16 ABC,24/08/2021 17 AAA,23/08/2021 15 ABC,24/08/2021 22 ABC,23/08/2021 23" | multikv forceheader=1 | table HostName LastConnected | eval LastConnected1=strptime(LastConnected,"%d/%m/%Y %H") |stats list(LastConnected) as LastConnected by HostName LastConnected1 | streamstats values(LastConnected1) as previousConnected by HostName window=1 current=f | eval concurrent=if(LastConnected1-previousConnected = 60*60,1,0) | eval span=if(concurrent=0 AND mvcount(LastConnected)>=2,1,0)
... View more