below example sums the duration when a machine is not running.
| sort 0 - time
| transaction startswith=running="0" endswith=running="1" keeporphans=f keepevicted=f
| timechart span=1h sum(duration)
first transaction of an hour:
what happens to a transaction that rolls over into the hour?
will it report against 13th hour because the transaction takes the first event's timestamp...
like this one:
... View more