Some observations...
1) You are only triggering once when the time taken goes beyond a threshold ten percent of the time in the prior hour. And, if it does that, you don't want to know again for three hours. This is not a valid real time use case. Change this to indexed real time or near-real time (as in, run once 1m or per 5m), and you will avoid a lot of stress on the machines, and a lot of headaches in how things work.
2) Once you make the changes, you can add your custom condition to the SPL as a final where clause, then trigger on count >0
3) This could be rewritten to be more straightforward. You are checking that at least ten percent of your time_taken values are above 20 and that there are more than 30 events in the hour. So, the following is mathematically equivalent.
<base search>
| eval is_slow=if(time_taken>20000,100.00,0.00)
| stats count, avg(is_slow) as pct_slow
| where pct_slow> 10.00 AND count>30
... View more