Best practice to keep track of current service state

[Simon]

Hi folks

I'm logging the state of services in a log when they're getting started or stopped, nothing special.
From your experience, what's the best practice to keep the current state of each service in a dashboard, but without having to search over a large timerange? It might be possible a service was restarted months ago but my dashboard should not search more than 24 hours. Also note that logging the current state of the service is not an option.
I'm thinking about a CSV with a scheduled search, e.g. running every 5 minutes to compare if the state has changed but maybe there are better options, e.g. introduced with Splunk 6 or so.

Thanks,
Simon

[Ayn · Accepted solution]

Whenever I see "state" in a question I almost link to this blog post on the subject, it should prove useful in your case as well: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

[Simon]

Perfect, thanks!