Help on this record select

[yangadounb]

I have the record like this:  

_time  id status 

1        x     yes

1         x     no

2          x      yes

1          x      unknow 

I want to return the record based on status value: if status has yes ,then return the lasted row that has yes. if there is none yes value then I want the row with no,  if there is none yes or none no, return unknow row.

[yangadounb]

_time  id status 

1        x     yes

1         x     no

2          x      yes

1          x      unknow 

1        y     yes

1         y     no

2         y    yes

1          y      unknow 

2         z   yes

1          z    unknow 

[ITWhisperer]

| eval stat=case(status="yes",0,status="no",1,status="unknow",2)
| sort 0 stat - _time
| streamstats count by id
| where count = 1

[ITWhisperer · Accepted solution]

| eval stat=case(status="yes",0,status="no",1,status="unknow",2)
| sort 0 stat - _time
| head 1

[yangadounb]

sorry not to make this clear ,  I have more records than that.