end_time syntax - ipSec VPN report

Almost done with the following BUT, something is wrong and i dont get it. I cannot extract user_name from the syntax bellow, any ideas whats wrong ? Thx.

SELECT

  a.`user`,a.login,b.logout,b.duration,b.transferred_bytes

FROM     ###( SELECT   `user`,min(from_dtime(dtime)) AS login,tunnelid         FROM     $log-event          WHERE    action='tunnel-up' and $filter          GROUP BY `user`,tunnelid)### a,          ###( SELECT   max(from_dtime(dtime)) AS logout,duration,sum(sentbyte+rcvdbyte)AS transferred_bytes,                            tunnelid                   FROM     $log-event                   WHERE    action='tunnel-down' and $filter                   GROUP BY duration,tunnelid HAVING   sum(sentbyte+rcvdbyte)>0 )### b WHERE    a.tunnelid=b.tunnelid ORDER BY login,          `user`