Getting max/last value on different period

[Altexec]

Hello,

I have an index with a field that record how long a computer has been running. Basically, when I display the information of a computer on 2 days I get this :

I would like to get the max value before each 'shutdown',  where the value reset to 0 after. Any simple way I could do that ?

[ITWhisperer]

Try something like this

| streamstats window=2 current=f latest(sys_cpu_total_ms) as previous_sys_cpu_total_ms
| eval max_before_reset=if(isnull(sys_cpu_total_ms) OR sys_cpu_total_ms==0, previous_sys_cpu_total_ms, null())