I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:
... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer
I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!