Splunk Search

How to extract the Referrer Field from the first event of a Transaction?

faramarz
Path Finder

I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:

... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer

I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!

Best,
F

1 Solution

lguinn2
Legend

In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this

 ... | transaction sessionId endswith=eventName=orderplaced 
| search eventName=subscription 
| eval Referrer = mvindex(referrer, 0)
| top Referrer

This should give you the referrer from the first event in each transaction.

View solution in original post

somesoni2
Revered Legend

Can you post some sample events? Does the Referrer present in all events that constitutes a transaction OR just in the first event?

0 Karma

faramarz
Path Finder

shows up in most events in the transaction. I thought of approaching with mvindex, and it seems to work best.

0 Karma

lguinn2
Legend

In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this

 ... | transaction sessionId endswith=eventName=orderplaced 
| search eventName=subscription 
| eval Referrer = mvindex(referrer, 0)
| top Referrer

This should give you the referrer from the first event in each transaction.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!