Group events by last occurance of status field value

[ips_mandar]

I want to group events with last occurance of notnull field value
ex. I am grouping events which startswith:logon and I want to ends with last value occurnce of field status
I tried below but unable to achieve it

| transaction source mvlist=status startswith="(Logon:)" endswith=eval(isnotnull(status))

but this is grouping events with first occurance of status and not last
any help will be appreciated.

[masonmorales]

Would this work?

| transaction source mvlist=status startswith="(Logon:)" endswith="status=*"
| where isnotnull(status) 

[ips_mandar]

Nope this won't help it will stop grouping of event when first notnull status field value found but I want last notnull value.

[diogofgm]

Have you tried to eval the status by before using transaction command? | eval has_status = isnotnull(status) and use then use `endswith=has_status=1

Can you post an example of you data?

[ips_mandar]

I am calculating status field value based on some condition and I wanted events which are null in status as well for further calculation.
below is sample data-

2019-08-19|09:37:36.806|Logon:ABC
2019-08-19|09:38:36.806|State: failed:True
2019-08-19|09:39:36.806|State: failed:True,xyz, status=true
2019-08-19|09:40:36.806|State: failed:True,fdg
2019-08-19|09:39:36.806|State: failed:True,xyz, status=false
2019-08-19|09:39:36.806|State: failed:True,fds

I want to group above first 5 events in one but I am able to group first 3 events only and I want to group till last occurance of status.

[diogofgm]

do you have any key field to identify a "transaction" rather that the source? Also can the last status be different than false?

[ips_mandar]

key field to identify is source only and last occurring status can be false or true