I am trying to get the data only when my lastlogon(field name) is Null. but the above query is still giving me data for both Null and non Null values.
Fields are case sensitive and also sometimes "empty" (i.e. == ""). You can check for both like this:
(isnull(LASTLOGON) OR LASTLOGON=="")
Field name are case-sensitive - try this
| where isnull(LASTLOGON)