How to write a search to track the time when service assignment changes between multiple hosts?

[thegeekthedude]

We have a system where, when a service name (a unique service name referenced by service=service_N where N=1 to 20) dies, it gets assigned to another host. To explain further...

We have service=service1 running on host=hostname1 initially. After sometime, because of some reason, service1 dies on hostname1, but a new service comes up on another host with the same name. So after a time T, service=service1 is running on host=hostname2. I am able to get the changing state of the service name from the event logs in Splunk using the search:

service=service1 | stats value(host) by service

and I get this:

service1 | hostname1
         | hostname2

1. How do I capture the time when the service name assignment changed?
2. What is the best way to graph this data when service=service* ?

Thanks

[sundareshr]

Try this

your search criteria | streamstats current=f range(_time) as diff by service | table service, host, diff