How to search duration of time above a percentage?

[mjones414]

I have data that has a watermark percentage, and a consumed percentage in a timechart. I want to determine how much time is spent above the watermark in a given window of time. How can I do this?

example:

.. | timechart span=4h avg(percent) as PercentUsed | eval "75th Percentile"=75 | ???transaction PerentUsed>"75th Percentile"???

[lguinn2]

It should be easy to identify the number of timespans that were above the threshold and then do the math to get the time over...

yoursearchhere
| timechart span=4h avg(percent) as PercentUsed 
| eval "75th Percentile"=75
| eval over_threshold = if(PercentUsed>75,1,0)
| stats sum(over_threshold) as spans_over
| eval time_out_compliance = tostring(spans_over * 4 * 60 * 60,"duration")
| fields - over_threshold spans_over