I assume that want you want to do here is create a sliding window of 6 events and select those windows that start with 4624 and end with 4624. Given that you cannot do this with transaction (if you use the same startswith and endswith it gives all transactions to be single events), I will try to show you how you can do this using streamstats .
index=myindex source=/my/folder/raw.log.gz xxx.xxx.xxx.xxx | sort -Time | eval ip="xxx.xxx.xxx.xxx" | streamstats list(win_event) as event_window window=6 by ip | eval window_len=mvcount(event_window) | eval window_first=mvindex(event_window, 0) | eval window_last=mvindex(event_window, 5) | where window_len = 6 AND window_first=4624 AND window_last=4624
... View more