It just so happens the important service is my splunk indexing, and I'm tracking when the queues become so full the network ports are shut off.
I found a way to do this, but it requires a set time range, because you have to hack _time a few times in the search. The idea is to turn the single "on" events into four events - the beginning and end times of the "on" status - and the "off" status just before and after the "on". Then use "connect points" to create the shape!
The idea is this:
Create the transactions, or pull out some sort of events that you can create a starttime and endtime from.
In this case, I used periods when the indexer was unable to receive data because its network port was closed due to over 5 minutes of blocked queues. Transaction gives me _time and _time + duration to use.
Create starttime and endtime and snap them down to the 5 minute boundary.
Create an earlier time by subtracting one 5-minute time period from starttime and a later time by adding one 5-minute period to endtime
Create one big field that you will split into four "events" for graphing - earlier and later with 0s, and starttime and endtime with 1s.
Split out the field with makemv, and explode into different events using mvexpand
re-create the _time, split-by field and value of 0 or 1 for each "exploded" event
Graph them, making sure to select "connect points" as the option for null values!