try like:
...|dedup _time |sort -_time|table licUser licType licPC _time
or
...|sort -_time|stats first(licUser) first(licType) first(licPC) by _time|
Dedup keeps the first event seen. Since searches are performed from most recent to oldest, it will keep the newest event regardless of what other things you attempt in the search string.
I'd recommend that you try | stats earliest(field)
See more here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions
But this doesn't leave me with the fields I need to continue such as _time.
dedup command removes the subsequent duplicate results that match specified criteria. it's not means that it'll return the last event, but it return the first event that macth with creiterias. this event can be the first, the last ...
if you want the last, you can use last function to do that.
... |last(licUser) last(licType) last(licPC) by -_time|...