select remip, coalesce(nullifna(`user`), ipstr(`remip`)) as user_src, from_dtime(min(coalesce(dtime, 0))) as start_time, from_dtime(max(coalesce(dtime, 0))) as end_time, (max(coalesce(duration, 0))/60) as duration from $log where $filter and subtype='vpn' and tunneltype like 'ssl%' and action in ('tunnel-up', 'tunnel-down') and coalesce(nullifna(`user`), ipstr(`remip`)) is not null and tunnelid is not null group by devid, vd, remip, user_src, tunnelid, tunneltype