Dashboards & Visualizations

What does "Last Update" signify in default dashboard? It's NOT the last event which in some cases was months ago . . .

krussell101
Path Finder

In the default dashboard there are 5 panels. Many of them, including "Hosts", includes a "Last Update" column. I fixed all the hostname configurations in July, but I'm still seeing several old hostnames in the list with a "Last Update" value of today. Yet when I click on that host, it shows me that the last event came in back in July. So what does "Last Updated" mean?

Thanks!

Tags (1)
0 Karma
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

last updated means the last time an event was received for that particular host. If you're seeing old hostnames, chances are that you've still got older indexed events containing the old hostname configurations, as you can't edit data in Splunk retroactively. Keep in mind what last updated doesn't mean. It does not mean the last indexed timestamp of an event which Splunk has processed, but rather the last time something was updated, irrespective of the timestamp. It is entirely possible for this scenario to occur if for some reason you're having issues with timestamp extraction. It could be that 1) your indexing historical data, or 2) Splunk is having problems extracting the timestamps from your events.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

last updated means the last time an event was received for that particular host. If you're seeing old hostnames, chances are that you've still got older indexed events containing the old hostname configurations, as you can't edit data in Splunk retroactively. Keep in mind what last updated doesn't mean. It does not mean the last indexed timestamp of an event which Splunk has processed, but rather the last time something was updated, irrespective of the timestamp. It is entirely possible for this scenario to occur if for some reason you're having issues with timestamp extraction. It could be that 1) your indexing historical data, or 2) Splunk is having problems extracting the timestamps from your events.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...