What does "Last Update" signify in default dashboard? It's NOT the last event which in some cases was months ago . . .

[krussell101]

In the default dashboard there are 5 panels. Many of them, including "Hosts", includes a "Last Update" column. I fixed all the hostname configurations in July, but I'm still seeing several old hostnames in the list with a "Last Update" value of today. Yet when I click on that host, it shows me that the last event came in back in July. So what does "Last Updated" mean?

Thanks!

[jbsplunk · Accepted solution]

last updated means the last time an event was received for that particular host. If you're seeing old hostnames, chances are that you've still got older indexed events containing the old hostname configurations, as you can't edit data in Splunk retroactively. Keep in mind what last updated doesn't mean. It does not mean the last indexed timestamp of an event which Splunk has processed, but rather the last time something was updated, irrespective of the timestamp. It is entirely possible for this scenario to occur if for some reason you're having issues with timestamp extraction. It could be that 1) your indexing historical data, or 2) Splunk is having problems extracting the timestamps from your events.