OK, I've managed to create a table row called Duration by adding this to my script:
Left Join (Table) Load
if([IncidentStatus]='closed', interval([EndTime]-[StartTime],'hh')) as [DurationTime]
How do I report a sum of "critical" events that has a DurationTime more than for example 24 hours.
I would like a table or chart saying:
Critical violations: 1
Average violation: 2