index="np_dpa" PROXYNAME="ProcessUBIDeviceFulfillmentCommunication" Application="Datapower" (TransactionStatus="FAIL" OR TransactionStatus="SUCCESS") TransactionDesc="VOUCHER_INVALID"
| stats max(_time) as _time values(PolicyNumber) as PolicyNumber values(DeviceFulfillResp) as DeviceFulfillResp values(DeviceFulfillErrorVins) as DeviceFulfillErrorVins values(TransactionStatus) as TransactionStatus by CorrelationId
| search NOT TransactionStatus="SUCCESS"
| sort _time
That'll load both successes and failures, bunch up all events for an ID, and discard those that have a success.