Given the following events
| HOST | VALUE |
| Host1 | 1 |
| Host2 | 4 |
| Host3 | 2 |
| Host2 | 7 |
| Host3 | 5 |
| Host1 | 8 |
How do I maintain the latest value for each host to give result like below?
| HOST | VALUE | LATEST |
| Host1 | 1 | Host1-1 |
| Host2 | 4 | Host1-1,Host2-4 |
| Host3 | 2 | Host1-1, Host2-4, Host3-2 |
| Host2 | 7 | Host1-1, Host2-7, Host3-2 |
| Host3 | 5 | Host1-1, Host2-7, Host3-5 |
| Host1 | 8 | Host1-8, Host2-7, Host3-5 |
|makeresults
| eval _raw="HOST VALUE
Host1 1
Host2 4
Host3 2
Host2 7
Host3 5
Host1 8"
| multikv forceheader=1
| table HOST VALUE
| rename COMMENT as "this is your sample. from here, the logic"
| reverse
| streamstats count
| reverse
| eval tmp=count."_".HOST."_".VALUE
| streamstats values(tmp) as tmp
| streamstats count as session
| mvexpand tmp
| rex field=tmp "\d_(?<HOST>\w+)_(?<VALUE>\d)"
| streamstats first(VALUE) as VALUE by session HOST
| eval tmp2=HOST."-".VALUE
| streamstats first(HOST) as HOST first(VALUE) as VALUE values(tmp2) as LATEST by session
| stats values(LATEST) as LATEST by session HOST VALUE delim=","
| fields - session
| nomv LATEST