You definitely have a very inefficient search with much redundancy in it. Try this one and see if it gives you what you need:
index=perfmon counter="*" collection="*" | stats sparkline(avg(Value)) AS Trend_Avg_Disk_Bytes_Write avg(Value) AS AVG_KB min(Value) AS MIN_KB max(Value) AS MAX_KB by host | eval AVG_KB=round((AVG_KB)/1024 ,1) | eval MIN_KB=round((MIN_KB)/1024 ,1) | eval MAX_KB=round( (MAX_KB)/1024 ,1)
As far as creating an "over-threshold" chart, try something like this:
index=perfmon counter="*" collection="*" | timechart span=1h max(Value) AS MAX_KB by host | eval MAX_KB=round((MAX_KB)/1024 ,1) | where MAX_KB>10
... View more