Have a look at the wikichip page for
hash tables for an overview of how they work. The linked page for /hmake also has some things to watch out for when translating to hashtables.
Unless you use buckets=1, which can be slower for large number of items, items will appear to be listed in a scrambled order. If you need to keep track of the last line, and don't care so much about the order of the prior items, you can have a special item named LASTLINE which you write the new stuff to. But immediately prior to overwriting LASTLINE, you would first add the existing LASTLINE data to another item in the table. I've not tested this, but it should give you a headstart.
#write only the hostmask or ip address:
on *:DNS: {
if ($hget(dns,line_num)) hadd DNS $v1 $hget(DNS,lastline)
hinc -m DNS line_num
hadd DNS lastline $raddress
}
This gives you a table full of items which are integers plus another pair of items named line_num and lastline.
#retrieving the last added line:
var %f = *!*@ $+ $hget(DNS,lastline)
Note that ONLY if buckets=1, your last added line will always be $hget(DNS,1). (Which isn't the same as the 1st item in the linked list of items => $hget(DNS,1).item)
Using a higher bucket count has the advantage of making it much quicker to search for the 5th item among 10 thousand items.
Since hashtables aren't saved like global variables are, you might wish to have a timer which /hsave's your table to disk at time intervals or after N items are added to the table.