I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:
... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer
I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!
Best,
F
In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this
... | transaction sessionId endswith=eventName=orderplaced
| search eventName=subscription
| eval Referrer = mvindex(referrer, 0)
| top Referrer
This should give you the referrer from the first event in each transaction.
Can you post some sample events? Does the Referrer present in all events that constitutes a transaction OR just in the first event?
shows up in most events in the transaction. I thought of approaching with mvindex, and it seems to work best.
In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this
... | transaction sessionId endswith=eventName=orderplaced
| search eventName=subscription
| eval Referrer = mvindex(referrer, 0)
| top Referrer
This should give you the referrer from the first event in each transaction.