Your searches are different between DS and manual search.
```WRONG TIME STAMP - MINUTE```
index="netscaler" host=*
| rex field="servicegroupname" "\?(?<Name>[^\?]+)"
| rex field="servicegroupname...
See more...
Your searches are different between DS and manual search.
```WRONG TIME STAMP - MINUTE```
index="netscaler" host=*
| rex field="servicegroupname" "\?(?<Name>[^\?]+)"
| rex field="servicegroupname" "(?<ServiceGroup>[^\?]+)"
| rename "state" AS LastStatus
| eval Component = host."|".servicegroupname
| search Name=*
| eval c_time=strftime(Time,"%m/%d/%y %H:%M:%S")
| streamstats window=1 current=f global=f values(LastStatus) as Status by Component
| where LastStatus!=Status
| eval Time = c_time
| table _time, host, ServiceGroup, Name, Status, LastStatus
```CORRECT TIME STAMPE```
index="netscaler" host=*
| rex field="servicegroupname" "\?(?<Name>[^\?]+)"
| rex field="servicegroupname" "(?<ServiceGroup>[^\?]+)"
| rename "state" AS LastStatus
| eval Component = host."|".servicegroupname
| search Name=*
| streamstats window=1 current=f global=f values(LastStatus) as Status by Component
| where LastStatus!=Status
| table _time, host, ServiceGroup, Name, Status, LastStatus