Security

Splunkweb referrer missing since 6.5.5

ehudb
Contributor

In Splunk 6.5.3, We've been using document.referrer to get the url when linking from Splunk dashboard to external web server.
We've been using that referrer to get the previous sid and use that within our external web app.

After upgrading to Splunk 7.0.2, we found out Splunk no longer exposure the referrer, therefor we cannot use it to get the sid after navigating to external link.
I have also installed 6.5.5 and 6.5.0 and found out the referrer feature exists on 6.50 but do not exists anymore on 6.5.5, so it must have been stopped somewhere in the middle.

Is there any way to return the referrer attribute after navigating out from Splunk dashboard?

Example of achieving the referrer attribute:
1. Open browser console
2. Write 'document.referrer'
3. Result on Splunk 6.5.0:
"https://splunksh:8000/en-GB/app/search/search"
Results on Splunk 6.5.5+:
""

Tags (1)
0 Karma
1 Solution

niketn
Legend

@ehudb, can you try window.location.href instead of document.referrer?

PS: If QueryString is present and you dont need it, you can truncate the same using JavaScript.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@ehudb, can you try window.location.href instead of document.referrer?

PS: If QueryString is present and you dont need it, you can truncate the same using JavaScript.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ehudb
Contributor

@niketnitay , window.location.href shows the current url, while document.referrer shows the previous url (the one that linked to this site)

0 Karma

niketn
Legend

@ehudb use window.location.href to store the URL variable and pass on to the external page as quesryString.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ehudb
Contributor

Ok I eventually used javascript to extract that data, so that's a decent workaround.
Can you make your comment as an answer so I can mark that as correct answer?

BTW, I used your User talk on splunk wiki a lot, thanks for that!

0 Karma

niketn
Legend

@ehudb glad it worked for you. I have converted my comment to answer. Please accept and up vote the comment/s that helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...