| bin _time as spantime span=1d
| stats list(Remark) as Remark list(EventContents) as EventContents count list(_time) as times earliest(_time) as earliesttimes latest(_time) as latestt by AccessOwnerNAme spantime
| convert timeformat="%d.%m.%Y" ctime(spantime) as spantime
| convert timeformat="%T" ctime(times) as times, ctime(earliesttimes) as earliesttimes, ctime(latestt) as latestt
| eval latestt1=latestt, earliesttimes1=earliesttimes | convert dur2sec(latestt1), dur2sec(earliesttimes1)
| eval dayduration1=latestt1-earliesttimes1 | eval dayduration=tostring(dayduration1, "duration")
| eval earliesttimes2=earliesttimes1-32400 | eval field_in_hhmmss1=tostring(earliesttimes2, "duration")
| eval latestt2=64800-latestt1 | eval field_in_hhmmss2=tostring(latestt2, "duration")
| eval latestt3=latestt1-64800 | eval field_in_hhmmss3=tostring(latestt3, "duration")
| eval All_time="Come ".earliesttimes."
"."Has left ".latestt
| sort -Remark
| fields AccessOwnerNAme spantime All_time dayduration field_in_hhmmss1 field_in_hhmmss2 field_in_hhmmss3 Remark times
| rename spantime as Day, earliesttimes as "First event", latestt as "Last event", field_in_hhmmss1 as "Late", dayduration as "Difference between first and last event", field_in_hhmmss2 as "Early departure", field_in_hhmmss3 as "Recycling"
... View more