What is the difference between lastTime and recentTime in a metadata search?

[sfmandmdev]

What is the difference between lastTime and recentTime in a metadata search?

[sfmandmdev]

Thanks Stephen. So just to confirm, recentTime is to most recent event time as lastTime is to most recent indexed time. Is that correct?

[Stephen_Sorkin]

The second half of your analogy doesn't sound quite right, as lastTime is the latest timestamp in the index.

[Stephen_Sorkin · Accepted solution]

The recentTime field represents the most recent timestamp seen for the given source, sourcetype or host, while lastTime represents the latest time ever seen for it.