Difference between lastTime and recentTime in metadata output

firstTime and lastTime show you the bounds of your timestamps for the entry in question. Think of this like | stats min(_time) as firstTime, max(_time) as lastTime.

The recentTime is the last timestamp that splunk received for the given entry in question. (This would be something like | sort -_indextime | head 1 | rename _time as recentTime.)

Keep in mind that the metadata command is really just pulling in saved statistics about your host/source/sourcetype that are stored within an individual index. (You can see them in the *.data files within the index folder and under individual bucket folders.) Keep in mind that the search examples above are really only meant to give you a comparable idea of what's going on, but they are probably over simplified.

So, unless you have events coming in out of order, then lastTime and recentTime will probably contain the same value.