Monitoring Windows Service State History

[TodaErika]

Hi fellow Splunkers,

Sorry I dont have enough karma points to post a link. I followed a Splunk blog post about monitoring windows service by Jason Conger.
TIPS & TRICKS
Monitoring Windows Service State History

I used wmi.conf to monitor my services on my servers.

In this snippet below for server1 the results turn out great I have a full service state history of the server1 for past 1day

index=windows sourcetype="WMI:Services" host=server1 earliest=-1d@d latest=now |
    streamstats current=false last(State) AS new_state last(_time) AS time_of_change BY DisplayName |
    where State != new_state |
    convert ctime(time_of_change) AS time_of_change |
    rename State AS old_state |
    table time_of_change host DisplayName old_state new_state

In this snippet below for I would wish to have a service state history of all my servers in my enviroment for past 1day. However the results turned out not the way I expected it to be.

index=windows sourcetype="WMI:Services" host=* earliest=-1d@d latest=now |
        streamstats current=false last(State) AS new_state last(_time) AS time_of_change BY DisplayName |
        where State != new_state |
        convert ctime(time_of_change) AS time_of_change |
        rename State AS old_state |
        table time_of_change host DisplayName old_state new_state

Did I miss out anything? Would be grateful if somebody pointed me in the right direction.

Thanks!