How can I view when the last data imports were?

[eyaluodba]

I have a dashboard that lists/groups recently updated dashboards and I just wanted to know if there was a way to also add another column to view and search the last data imports of those dashboards.

For an example one of the dashboards last Data import was 05/08/2017 ( see photo below)

So since my dashboard lists the other dashboards my team has made, is there a way to show when those dashboards had the last import?
My requested format would be:

Dashboard, Timestamp,& Last Data Import Date.

Hopefully this all makes sense. Please let me know if it doesn't. Thank you.

[DalJeanis]

If you can distinguish the kind of imports from data that is in the index, then I'd use the value of recentTime in the metadata for the index.

| metadata index=indexname  (then more stuff depending on what you need)

Here's some useful answers with specific metadata searches...

https://answers.splunk.com/answers/7471/difference-between-lasttime-and-recenttime-in-metadata-outpu...
https://answers.splunk.com/answers/148216/how-metadata-host-by-index-and-sourcetype-recenttime.html

[somesoni2]

Could you provide more information like your current query (which I assume showing "dashboard has last import") and/or sample events. Do other dashboard use the same/similar query?

[eyaluodba]

As of right now my query shows the most recent dashboard being updated, the time of the updates, the app name and the user updating it.

      <query>index=_internal source=*web_access.log* /app/ action=edit | rex "/app/(?&lt;app_name&gt;.\w+)/(?&lt;dashboard_name&gt;.\w+)" | table dashboard_name, _time, app_name, user</query>

What I want is to also show the last data imports too. The other dashboards use the same query, yes.

[adonio]

what do you mean by import?
do you mean the last event that has been calculated in the panels?
if that is the case, run the same search that populates panel and then ... | head 1 | table _time

[eyaluodba]

Yea that's exactly what I mean. The last event that's been calculated in the panels.

[adonio]

have to say that i think its a weird requirement. i think you try and add to each search something like:
... | stats latest(_time) as lastTime | eval lastEventTime=strftime(lastTime, "%F %H:%M:%S")

now you have the last event time f the search