I am looking for a search that returns an events(s) when the searched value remains for a set length of time. Using Windows performance monitoring searches I am searching for CPU "Peak" values but would like to add a time condition for length. Example:  eventtype="perfmon_windows" (Host="hostname") object="Processor" counter="% Processor Time" instance="*" | stats sparkline(avg(Value)) as Trend avg(Value) as Average, max(Value) as Peak, latest(Value) as Current, latest(_time) as "Last Updated" by Host | convert ctime("Last Updated") | sort - Current | eval Average=round(Average, 2) | eval Peak=round(Peak, 2) | eval Current=round(Current, 2) | where Peak>85  Right now that search works very well but if I get a quick spike of CPU it will go off. I would like to add something like when the CPU hits that Peak of 85 for something like 5 minutes or more.  ... View more