I found that the docs were lacking in defining and explaining this. On a ! metadata type=hosts search, what do firstTime, lastTime, and recentTime stand for, and how are lastTime and recentTime different? ... View more

say i am running a search like this: | metadata type=hosts | eval FirstSeen=firstTime | eval RecentSeen=recentTime | eval seconds_since=now()-recentTime | convert ctime(RecentSeen) | convert ctime(FirstSeen) | eval hours=floor(seconds_since/60/60) | eval minutes=floor((seconds_since-hours*60*60)/60) | eval seconds=seconds_since-hours*60*60-minutes*60 | fields host, source, sourcetype, FirstSeen, RecentSeen, hours, minutes, seconds It's basically grabbing the info from the metadata file (hosts.data) and telling me when was the first time and last time a host send data my way. Then i am calculating how many seconds ago this was, and calculating it in hours, minutes and seconds. Thats all dandy and works perfectly. Notice however that i would like to see the source and sourcetype for this last event that came from that host. I know that i can run | metadata type=sourcetypes/sources and get similar information, but i have a feeling that i should be able to, perhaps using a subsearch?, get the source/sourcetype info some way.. For example, i can use a search like: " _time=<somenumber scrapped from recentTime> | table source, sourcetype " but am failing in passing the necessary data from one search to the other. Also, is there a better way of getting "hours, minutes, and seconds" in my search above? TIA .gz ... View more