Thank you very much. That has led me in the right direction. I do want to filter out the a | c value, which I've been able to do now by applying stream stats to both fields, and then taking their difference. Any non-zero value would then indicate the items I would like to filter out.
streamstats count as session_rank by session_id | streamstats count as object_rank by object_id | eval request_rank=(session_rank-object_rank)
... View more