How to get the result set of the last sample without using head search command

[lpolo]

Hi,

Any idea how to get the result set of the last sample without using head. Let's say we have a summary index with the following log set:

time_1 G=1 orig_host=a
time_1 G=1 orig_host=b
time_1 G=3 orig_host=c

time_2 G=3 orig_host=a
time_2 G=2 orig_host=b
time_2 G=3 orig_host=c

Using the search command "head" I can get my last sample if I know the number of logs per sample. For example:

sourcetype=x|head 3|table _time orig_Host G

How can I get the same result set without using the head search command?

Thanks,
Lp

[sdaniels]

I think you could probably modify the following answer:

http://splunk-base.splunk.com/answers/52891/most-recent-event-from-each-source

Just change to | metadata type=hosts since you want to look up data based on a host.

[lpolo]

I modified the question to clarify the scenario. I tried the example you sent me before I could not make it work. Any idea.

Lp