Try this:
index=icinga_logs sourcetype=icinga hu1secsoudc1 "*status_interface*"
| rename COMMENT "This solution presumes every event has a 'status' field which is either 'OK', 'WARNING' or 'STOPPED'"
| rex "(?i)^(?:[^;]*;){2}(?P<status>[^;]+)"
| reverse
| streamstats current=t count(eval(status="OK")) AS GoodSessionID count(eval(status="WARNING")) AS BadSessionID
| eventstats latest(status) AS lastGoodStatus latest(_time) AS lastGoodTime by GoodSessionID
| eventstats latest(status) AS lastBadStatus latest(_time) AS lastBadTime by BadSessionID
| eval lastGoodTime=if(lastGoodStatus="WARNING, lastGoodTime, now())
| eval lastBadTime=if(lastBadStatus="WARNING", now(), lastBadTime)
| where status!="STOPPED"
| rename COMMENT "Keep only 'OK' and 'WARNING' events"
| eval goodDuration= if(status="OK", lastGoodTime - _time, 0)
| eval badDuration= if(status="WARNING", lastBadTime - _time, 0)
| stats sum(goodDuration) AS TotalGood sum(badDuration) as TotalBad
| eval Total = (TotalGood+TotalBad) | eval Percentage = (TotalGood/Total)*100 | table Percentage
... View more