https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31075#M6396 <P>Thanks Stephen. So just to confirm, recentTime is to most recent event time as lastTime is to most recent indexed time. Is that correct?</P> Tue, 17 Aug 2010 21:05:19 GMT sfmandmdev 2010-08-17T21:05:19Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31073#M6394 <P>What is the difference between lastTime and recentTime in a metadata search?</P> Tue, 17 Aug 2010 03:49:22 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31073#M6394 sfmandmdev 2010-08-17T03:49:22Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31074#M6395 <P>The recentTime field represents the most recent timestamp seen for the given source, sourcetype or host, while lastTime represents the latest time ever seen for it.</P> Tue, 17 Aug 2010 04:23:35 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31074#M6395 Stephen_Sorkin 2010-08-17T04:23:35Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31075#M6396 <P>Thanks Stephen. So just to confirm, recentTime is to most recent event time as lastTime is to most recent indexed time. Is that correct?</P> Tue, 17 Aug 2010 21:05:19 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31075#M6396 sfmandmdev 2010-08-17T21:05:19Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31076#M6397 <P>The second half of your analogy doesn't sound quite right, as lastTime is the latest timestamp in the index.</P> Tue, 17 Aug 2010 22:05:55 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/31076#M6397 Stephen_Sorkin 2010-08-17T22:05:55Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/705502#M238853 <P>To add some clarity as that accepted answer is still quite vague or confusing...</P><P>The easiest way would be to relate these field names to _time and _indextime</P><P>recentTime = _indextime = last actual time this host was heard from by index(es) defined in metadata command, or in other more specific terminology, the last time it wrote logs to an index</P><P>lastTime = _time = time stamp of the events from that host by index(es) defined in metadata command, in other words the latest timestamp in the set of events defined by the search</P> Thu, 28 Nov 2024 16:24:55 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-lastTime-and-recentTime-in-a/m-p/705502#M238853 moliminous 2024-11-28T16:24:55Z