Create custom - Ipsec change state history

Pls try: 

log type: event

select distinct on (tunnelid) from_itime(max(e_time)) as e_time, tunnelid, (case when action='tunnel-down' then 'down' else 'up' end) as status, (case when min(s_time)=max(e_time) then max(max_duration) else max(max_duration)-min(min_duration) end) as duration from ###(select min(coalesce(dtime, 0)) as s_time, max(coalesce(dtime, 0)) as e_time, tunnelid, max(coalesce(duration,0)) as max_duration, action, min(coalesce(duration,0)) as min_duration from $log where $filter and subtype='vpn' and tunneltype like 'ipsec%' and not (tunnelip is null or (tunnelip='0.0.0.0' and logver is null)) and action in ('tunnel-stats', 'tunnel-down', 'tunnel-up') and tunnelid is not null group by tunnelid, action order by e_time desc)### t group by tunnelid, status order by tunnelid, e_time desc

regards,

hz