I tried the following example but it seems not really efficient and working : index=* Data IN ("testA", "test", "test2", "test3") | transaction Data | sort _time | eval testA_present=if(match(Data, "testA"), "true", "false") | eval test_present=if(match(Data, "(test|test2|test3)"), "true", "false") | eval testA_last=if(testA_present="true" AND test_present="true", mvindex(split(Data, "|"), -1) == "testA", "false") | where (testA_present="true" AND test_present="true" AND testA_last="false") OR (testA_present="false" AND test_present="true")
... View more