Let us assume that you have an status field that says either "Fail" or "Clear" (it could be "OK" or "Bad" or whatever; it doesn't really matter). You can do it like this:
... | streamstats current=f last(_time) AS nextTime by host | eval secondsInCurrentState = nextTime - _time | eval minutesInCurrentState = round(secondsInCurrentState /60, 0) | where status="Fail" | timechart span=1h count by minutesInCurrentState
This shows how many errors started in each hour of the day and counts them in buckets of minutes-of-duration. I believe that this is what you were asking but if it is not exactly, it should get you close.