on a '| metadata type=hosts' search, what do each of the fields stand for?

[Genti]

I found that the docs were lacking in defining and explaining this. On a

! metadata type=hosts

search, what do firstTime, lastTime, and recentTime stand for, and how are lastTime and recentTime different?

[Genti · Accepted solution]

firstTime, as the name says, is the first timestamp the indexer sees an event from a host.
lastTime, is the latest timestamp the indexer has seen an event from a host.
recentTime, is the most recent timestamp the indexer has seen an event from a host.

Shouldnt recentTime and lastTime be the same thing then? - No, in most cases, when the data is streaming live, these are equal, however if the data is historical, then these are (could be) different.

Here is an example to illustrate the differences: Assume we have host xyz which will send 3 events in the following order. The first one has a timestamp of 100, the second one a timestamp of 200, and the third one has a timestamp of 150. Here is a table showing how the specific times will appear:

event | timestamp | firstTime | lastTime | recentTime
-----------------------------------------
1st   | 100       | 100       | 100      | 100
2nd   | 200       | 100       | 200      | 200
3rd   | 150       | 100       | 200      | 150