Just noticed this question which is unanswered, so thought of adding the answer. You need to rollup this way (120 s is the time duration): query = "max:system.mem.used{host:}.rollup(max, 120)"