The easiest way to deduplicate data is with an aggregate function like groupBy(). You can add as many fields as you need to identify a unique value. For example, to get a deduplicated list of one field:

groupBy([user])

Or multiple:

groupBy([user,hostname])

Both return an aggregated view with a count; if you are not interested in the actual values or counts, specify an empty list of functions as the aggregator:

groupBy([user,hostname],function=[])

This returns only the matching unique (deduplicated) combinations:

This will not return the rest of the event data, just the aggregated values.

To get the last event matching a unique combination, use tail(1) as the aggregator function:

groupBy([user,hostname],function=tail(1))

Which will cause groupBy() to operate as a filter on the event and return the last matching unique combination.