@Raja_Selvaraj  DATETIME_CONFIG = CURRENT should work normally. But observed few times with monitor input, Splunk still scans the event content or file metadata (modtime) to determine _time, even if DATETIME_CONFIG = CURRENT is set. Are you using monitor input? But you can use the modification at search time. Eg: BASE_SEARCH | eval _time = now() Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks! ... View more

Hi @Raja_Selvaraj , if you have more than 80 columns, how do you think that you can read 80 columns of values plus 80 columnd of differences from the previous values, it's anyway unreadable! Maybe you should think a different visualization! Anyway, you could use something like this: <your_search> | bin span=1d _time | stats count BY host _time | delta count AS previous_count | delta host AS previous_host | where host=previous_host | eval deltaA=previous_count-count Ciao. Giuseppe ... View more

Thanks for the reply!! The stats i am looking for single windows servers. | timechart latest('CPU') by process_name host timechart followed by process_name host does not work ... View more