Getting Data In

on a '| metadata type=hosts' search, what do each of the fields stand for?

Genti
Splunk Employee
Splunk Employee

I found that the docs were lacking in defining and explaining this. On a

! metadata type=hosts

search, what do firstTime, lastTime, and recentTime stand for, and how are lastTime and recentTime different?

Tags (3)
1 Solution

Genti
Splunk Employee
Splunk Employee

firstTime, as the name says, is the first timestamp the indexer sees an event from a host.
lastTime, is the latest timestamp the indexer has seen an event from a host.
recentTime, is the most recent timestamp the indexer has seen an event from a host.

Shouldnt recentTime and lastTime be the same thing then? - No, in most cases, when the data is streaming live, these are equal, however if the data is historical, then these are (could be) different.

Here is an example to illustrate the differences: Assume we have host xyz which will send 3 events in the following order. The first one has a timestamp of 100, the second one a timestamp of 200, and the third one has a timestamp of 150. Here is a table showing how the specific times will appear:

event | timestamp | firstTime | lastTime | recentTime
-----------------------------------------
1st   | 100       | 100       | 100      | 100
2nd   | 200       | 100       | 200      | 200
3rd   | 150       | 100       | 200      | 150

View solution in original post

Genti
Splunk Employee
Splunk Employee

firstTime, as the name says, is the first timestamp the indexer sees an event from a host.
lastTime, is the latest timestamp the indexer has seen an event from a host.
recentTime, is the most recent timestamp the indexer has seen an event from a host.

Shouldnt recentTime and lastTime be the same thing then? - No, in most cases, when the data is streaming live, these are equal, however if the data is historical, then these are (could be) different.

Here is an example to illustrate the differences: Assume we have host xyz which will send 3 events in the following order. The first one has a timestamp of 100, the second one a timestamp of 200, and the third one has a timestamp of 150. Here is a table showing how the specific times will appear:

event | timestamp | firstTime | lastTime | recentTime
-----------------------------------------
1st   | 100       | 100       | 100      | 100
2nd   | 200       | 100       | 200      | 200
3rd   | 150       | 100       | 200      | 150

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!