Thank you so much for the help ! I used latest in order not to need to sort events but it works really well on my side.    ... View more

Thanks a lot ! I used it for the solution ... View more

I tried the following example but it seems not really efficient and working :  index=* Data IN ("testA", "test", "test2", "test3") | transaction Data | sort _time | eval testA_present=if(match(Data, "testA"), "true", "false") | eval test_present=if(match(Data, "(test|test2|test3)"), "true", "false") | eval testA_last=if(testA_present="true" AND test_present="true", mvindex(split(Data, "|"), -1) == "testA", "false") | where (testA_present="true" AND test_present="true" AND testA_last="false") OR (testA_present="false" AND test_present="true") ... View more