The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this
| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)
If you want the last raw event as well, try this slower method.
index=* [| inputlookup yourHostLookup.csv | table host ] | dedup host
The tstats works on the indexed/metadata fields and _raw is not one of them so you would be able to get the last events timestamp and other metadata information using tstats but not the actual event. If that's OK, then try like this
| tstats max(_time) as latestTime WHERE index=* [| inputlookup yourHostLookup.csv | table host ] by host | convert ctime(latestTime)
If you want the last raw event as well, try this slower method.
index=* [| inputlookup yourHostLookup.csv | table host ] | dedup host