- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to extract the Referrer Field from the fir...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've broken my events up into transactions to determine whether a user purchased and subscribed, and once narrowed down, I am trying to extract the referrer field of the first event in the transaction. My search currently looks like this:
... | transaction sessionId endswith=eventName=orderplaced | search eventName=subscription | stats first(referrer) as Referrer | top Referrer
I am trying to get the referrer field of the first event, but first(referrer) doesn't seem to work. It returns an empty field for all transactions that are there. How do I access this? Thanks for the help!
Best,
F
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this
... | transaction sessionId endswith=eventName=orderplaced
| search eventName=subscription
| eval Referrer = mvindex(referrer, 0)
| top Referrer
This should give you the referrer from the first event in each transaction.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you post some sample events? Does the Referrer present in all events that constitutes a transaction OR just in the first event?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shows up in most events in the transaction. I thought of approaching with mvindex, and it seems to work best.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In a transaction, fields become multivalued if they appear in more than one event within the transaction. Try this
... | transaction sessionId endswith=eventName=orderplaced
| search eventName=subscription
| eval Referrer = mvindex(referrer, 0)
| top Referrer
This should give you the referrer from the first event in each transaction.
Introducing the Splunk Community Dashboard Challenge!
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Wondering How to Build Resiliency in the Cloud?
