Hi ,
Why don't you try case statements for this one. If the cpu went up to 85% and more then it will store the data in one field and vice versa
using eval - eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")
http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.22Y.22.2C....29
... View more