Try this:
| savedsearch rename1
| fields Date_Time Username Green Yellow Red
| sort 0 _time Username Green Yellow Red
| streamstats window=1 current=f list(_time) AS prevTime list(Green) AS RUN
| eval _time = strptime(Date_Time, "%Y/%m/%d %H:%M:%S")
| bin _time span=1h
| stats count(Green) AS Green sum(RUN) AS Count1 BY _time
| appendcols[|savedsearch rename2
| fields Date_Time Username Green Yellow Red
| sort 0 _time Username Green Yellow Red
| streamstats window=1 current=f list(_time) AS prevTime list(Green) AS RUN2
| eval _time = strptime(Date_Time, "%Y/%m/%d %H:%M:%S")
| bin _time span=1h
| stats count(Green) AS Green sum(RUN2) AS Count2 BY _time]
| appendcols[|savedsearch rename3
| fields Date_Time Username Green Yellow Red
| sort 0 _time Username Green Yellow Red
| streamstats window=1 current=f list(_time) AS prevTime list(Green) AS RUN3
| eval _time = strptime(Date_Time, "%Y/%m/%d %H:%M:%S")
| bin _time span=1h
| stats count(Green) AS Green sum(RUN3) AS Count3 BY _time]
| appendcols[|savedsearch rename4
| fields Date_Time Username Green Yellow Red
| sort 0 _time Username Green Yellow Red
| streamstats window=1 current=f list(_time) AS prevTime list(Green) AS RUN4
| eval _time = strptime(Date_Time, "%Y/%m/%d %H:%M:%S")
| bin _time span=1h
| stats count(Green) AS Green sum(RUN4) AS Count4 BY _time]
| eval PC = Count1+Count2+Count3+Count4
| accum PC
| eval Green = PC*3
| accum Green
| timechart span=1h values(Green) AS Target values(PC) AS Actual
You probably should move the strptime line farther up (but I did not do that because it will change your data).
... View more