https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203596#M59132 <P>I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:</P> <PRE><CODE>... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer </CODE></PRE> <P>I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!</P> <P>Best,<BR /> F</P> Wed, 02 Sep 2015 16:50:55 GMT faramarz 2015-09-02T16:50:55Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203596#M59132 <P>I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:</P> <PRE><CODE>... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer </CODE></PRE> <P>I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!</P> <P>Best,<BR /> F</P> Wed, 02 Sep 2015 16:50:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203596#M59132 faramarz 2015-09-02T16:50:55Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203597#M59133 <P>In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this</P> <PRE><CODE> ... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | eval Referrer = mvindex(referrer, 0) | top Referrer </CODE></PRE> <P>This should give you the referrer from the first event in each transaction.</P> Wed, 02 Sep 2015 19:14:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203597#M59133 lguinn2 2015-09-02T19:14:34Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203598#M59134 <P>Can you post some sample events? Does the Referrer present in all events that constitutes a transaction OR just in the first event?</P> Wed, 02 Sep 2015 22:10:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203598#M59134 somesoni2 2015-09-02T22:10:37Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203599#M59135 <P>shows up in most events in the transaction. I thought of approaching with mvindex, and it seems to work best. </P> Thu, 03 Sep 2015 04:56:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-the-Referrer-Field-from-the-first-event-of-a/m-p/203599#M59135 faramarz 2015-09-03T04:56:32Z