how - metadata host by index and sourcetype recentTime

[robf]

This search produces the most recent timestamp for every host for aa specific index

| metadata type=hosts index=windows |
convert ctime(*Time) | table host
index recentTime

how can i break it down a level further by last tinme a host reported in for a given sourcetype and index?

eg

    host   index    sourcetype   recenttime
    host1  windows   system      30/06/2014 04:55
    host1  windows   security    30/06/2014 05:15

[somesoni2]

There is no in-build metadata which gives this information grouped by index, sourcetype and host all.

You can try this to get the the timestamp of last written entry for index, sourcetype host combination. This is the fastest available search I believe for this requirement (other than @martin's which is specific to Splunk6).

|metasearch index=clm_transactions sourcetype=* host=* | stats max(_time) as recentTime by index sourcetype host

select appropriate time range for the search so that you can cover most of the host. It won't report for the hosts which have written any entries in given time range.

[strive]

metadata type=hosts doesn't contain sourcetye information.

Check this

http://answers.splunk.com/answers/10005/how-to-get-host-sourcetype-and-source-from-a-single-metadata...

You may need different combinations. This link http://answers.splunk.com/tags/metadata/ has questions tagged with metadata. Some of these may help you.

[strive]

|metasearch index=* sourcetype=* host=* | table index sourcetype host

This wont fetch recentTime

[linu1988]

Hello Rob,
If you are on Splunk 6 @martin_mueller 's answer will help you get the info.

http://answers.splunk.com/answers/145995/alert-if-source-stops-indexing

Or

you can maintain a lookup table and make the comparison with metadata.

Thanks,
L