First and Last event of Transaction

[Shashank_87]

Hi, I am working on a query where I need to join some events using a transaction command in Splunk. Below is my query where I am joining a particular web service request with a response using a "requestID" and then extracting the data. Now what happens is if the response contains an error, it will again try and may be next time it gets success. requestID remains same here.
Right now this query is just using the 1st response event which it encounters and reported as error even if it is not.

How do i extract the last of the responses so that i get the updated data whether it resulted in an error or success.

index=temp ("SoapMessage" "GetCustomerRequest") OR ("SoapMessage" "GetCustomerResponse")
| rex field=_raw ">(?[^<]+)<\/\w+?:requestID>"
| transaction requestID startswith="GetCustomerRequest" endswith="GetCustomerResponse" keepevicted=true
| search eventcount > 1

[xavierashe]

try this:

 index=temp ("SoapMessage" "GetCustomerRequest") OR ("SoapMessage" "GetCustomerResponse")
| rex field=_raw "\>(?[^\<]+)\<\/\w+?\:requestID\>"
| transaction requestID startswith="GetCustomerRequest" endswith="GetCustomerResponse" keepevicted=true mvlist=true
| search eventcount > 1
| eval  last_response=mvindex(response, -1)