The transaction command may be the right approach in this case. Take a look at this previous answer which is very detailed.
http://splunk-base.splunk.com/answers/29172/transaction-problems-with-lots-of-events-and-multiple-fields
From the docs (there are example transactions):
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction
The Transaction profiling app might be interesting for you to look at as well.
http://splunk-base.splunk.com/apps/29011/splunk-app-for-transaction-profiling-preview
... View more