VPN report hours per day

[gy14]

I am not a query guy so this has been difficult to understand, and i haven't found a canned one to do what i want.

I'm trying to create a report that will show say a specific user over the last 30 days but instead of aggregate time, how much time spent connected each day.  Powers that be want to see, 8+ hrs each day or if they were skipping out early on fridays.

something like

user1      MM/DD/YY  07:59

user1      MM/DD/YY   08:00

user2      MM/DD/YY    04:30

I have searched google and these forums but haven't gotten anything to work, possibly my version is newer than the commands i'm trying.  6.2

am i missing a canned one that does this? and overthinking.  or i definitely need a new dataset?

any thoughts are appreciated.

[gy14]

This got me most of the way there.  showing multiple days for individual users and remote IP.  now i want to add the duration to those days.

select from_dtime(dtime) as date, `user`, tunneltype, action , remip from $log where (tunneltype = 'ssl-tunnel') and action = 'tunnel-up' order by date desc