What is the difference between lastTime and recentTime in a metadata search?

[sfmandmdev]

What is the difference between lastTime and recentTime in a metadata search?

[sfmandmdev]

Thanks Stephen. So just to confirm, recentTime is to most recent event time as lastTime is to most recent indexed time. Is that correct?

[Stephen_Sorkin]

The second half of your analogy doesn't sound quite right, as lastTime is the latest timestamp in the index.

[Stephen_Sorkin · Accepted solution]

The recentTime field represents the most recent timestamp seen for the given source, sourcetype or host, while lastTime represents the latest time ever seen for it.

[moliminous]

To add some clarity as that accepted answer is still quite vague or confusing...

The easiest way would be to relate these field names to _time and _indextime

recentTime = _indextime = last actual time this host was heard from by index(es) defined in metadata command, or in other more specific terminology, the last time it wrote logs to an index

lastTime = _time = time stamp of the events from that host by index(es) defined in metadata command, in other words the latest timestamp in the set of events defined by the search