Try this ...
index=pcrf sourcetype=rac* ha_state=*
| fields _time ha_state host
| Eval ShowState=case( ha_state="Slave", 1, ha_state="Master", 3 , ha_state="King", 7)
| timechart avg(ShowState) as state by host
At any given span of _time , the host on the top line will be King, the next Master, and any on the bottom will be Slave. If a host changes state during the span, then the reading will show somewhere in between.
We've adjusted the scale 1-3-7 so that any switches from top-bottom or bottom-top (Slave+King) are unlikely to land exactly on the middle (Master). If you prefer, you can adjust them to 1-3-4 or whatever.
... View more