Dear @niks987 ,
Try below query ..
sourcetype=xyz OR sourcetype=abc
| eval Date=strftime(_time,"%d")
| dedup Date
| stats avg(cpu) as Infrastructure, avg(.iowait) as Application, avg(ram) as Database, count(Date) as Date by source.store_num
| rename store_num as Store_Number
| eval State=case(Infrastructure>90,"Severe",Application>90,"Severe",Database>90,"Severe")
| stats values(Infrastructure) as Infrastructure,values(Application) as Application,values(Database) as Database, sum(eval(if(Infrastructure>90 AND Application>90 AND Database>90, Date,0))) as Total_Days, values(State) as State by Store_Number
| table Store_Number,Infrastructure,Application,Database, State,Total_Days
Thanks ..
... View more