Once you assign that template to the nodes you would add this query to the Node Details view and then you can enter the amount of minutes you want to have it jump back in time and it will show you the top processes at that time. I find that it works best if you set it to show 12 rows (total cpu load, plus top 5 by cpu, plus total memory utilization, plus top 5 by memory).
SELECT tolocal(TimeStamp) as Timestamp
, cs.Component.DetailsUrl as [_linkfor_Name]
, cs.DynamicEvidence.ColumnLabel as Label
, cs.DynamicEvidence.StringData as Message
FROM Orion.APM.ComponentStatus cs
where cs.DynamicEvidence.StringData is not null
and cs.Component.Application.Name like '%snapshot%'
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community.
More than 150,000 members are here to solve problems, share technology and best practices, and directly
contribute to our product development process.