below example sums the duration when a machine is not running.
... | sort 0 - time | transaction startswith=running="0" endswith=running="1" keeporphans=f keepevicted=f | timechart span=1h sum(duration)
first transaction of an hour:
what happens to a transaction that rolls over into the hour?
will it report against 13th hour because the transaction takes the first event's timestamp...
like this one:
The timestamp of the transaction would be considered as the start time of the transaction which is in 13th hour, so your transaction would be counted for 13th hour, even though it ended in 14th. What's your requirement here? Do you want it to be counted for both hours?
@cmisztur, yes transaction will pick earliest time as the _time. Are you trying to create a transaction without id?