I run this search:
... | dedup userId name dt | transaction mvlist=t userId maxpause=900s | where mvindex(id, -1) == "1152921526082717650" | table name, dt
Which creates transactions based on userId that ends with the specified page id, and removes events that are equal in name and timestamp for each user. It gives me a result for instance like this:
What I want to do now, is remove all events that follow an event with the exact same name, that is I want to remove the second "C" event. The problem is, I do NOT want to remove the second "B" event, even though it already occured in the transaction. This means that I can not use dedup on the (name, userId) combination.