I have data that has a watermark percentage, and a consumed percentage in a timechart. I want to determine how much time is spent above the watermark in a given window of time. How can I do this?
.. | timechart span=4h avg(percent) as PercentUsed | eval "75th Percentile"=75 | ???transaction PerentUsed>"75th Percentile"???
It should be easy to identify the number of timespans that were above the threshold and then do the math to get the time over...
| timechart span=4h avg(percent) as PercentUsed
| eval "75th Percentile"=75
| eval over_threshold = if(PercentUsed>75,1,0)
| stats sum(over_threshold) as spans_over
| eval time_out_compliance = tostring(spans_over * 4 * 60 * 60,"duration")
| fields - over_threshold spans_over