How to group input and output request log?

[MayankMathur198]

We have our webservice logs on splunk having separate request (input) and response(output) log. There is one common unique id field between request and response log. But I want to match events in such a way to have count on basis of "requst_name" from request log and "response_cd" (where response_cd is not "00")from response log.

Example of request and response events:

REQUEST EVENT:

TYPE=REQUEST,ID=ABCDEF,REQUST_NAME=API_LOGGING_INFO, DATE=YYYY-MM-DD,TIME=HH:MM:SS

RESPONSE EVENT :

TYPE=RESPOMSE, ID=ABCDEF,RESPONSE_CODE=00
(Response_cd may have different values)

I have tried transaction commond to group events and then search for non "00" response-cd but search is taking very long time.

Thanks in advance!

[msivill_splunk]

As a starting point does the following help?

( source=request OR source=response ) response_cd != 00
| stats count by id, source
| stats count by id 
| where count > 1