I don't think you need the proccessor time filter in your base search. Let your stats worry about the calculation.
for similar requests, we've typically used min(). If the minimum over a period is greater than your threshold, then it was above your threshold the whole time. The avg() could be above the threshold even if it's dipping/spiking over that period.