How to extract the Referrer Field from the first event of a Transaction?

[faramarz]

I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:

... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer

I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!

Best,
F

[somesoni2]

Can you post some sample events? Does the Referrer present in all events that constitutes a transaction OR just in the first event?

[faramarz]

shows up in most events in the transaction. I thought of approaching with mvindex, and it seems to work best.

[lguinn2 · Accepted solution]

In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this

 ... | transaction sessionId endswith=eventName=orderplaced 
| search eventName=subscription 
| eval Referrer = mvindex(referrer, 0)
| top Referrer

This should give you the referrer from the first event in each transaction.