Splunk Search

In the top 10 values of the "http_referrer" field, why is the first value empty?

mistydennis
Communicator

I'm in the process of analyzing events in some of our download logs. When I click on "http_referrer" it brings up the top 10 values for this field, however the very first value is blank. This first value is significantly higher than the others, so I'm interested in where this traffic is coming from. What does a blank http_referrer field mean?

0 Karma
1 Solution

DalJeanis
Legend

According to this page over at stack overflow, http_referrer is an unreliable field. Blank means it wasn't filled in. in some cases, that means the browser was in a private window or otherwise had privacy enabled, in others it might indicate that the referring page just didn't care enough to code it.

http://stackoverflow.com/questions/6023941/how-reliable-is-http-referer

According to THIS page - https://gispunt.wordpress.com/2012/01/10/why-using-referer-header-as-a-security-mechanism-is-a-bad-i...

"Most modern browsers have a “enhanced
privacy mode” that will remove the
referrer header next to refusing all
sorts of other tracking mechanisms,
which the header was initially
designed for."

View solution in original post

DalJeanis
Legend

According to this page over at stack overflow, http_referrer is an unreliable field. Blank means it wasn't filled in. in some cases, that means the browser was in a private window or otherwise had privacy enabled, in others it might indicate that the referring page just didn't care enough to code it.

http://stackoverflow.com/questions/6023941/how-reliable-is-http-referer

According to THIS page - https://gispunt.wordpress.com/2012/01/10/why-using-referer-header-as-a-security-mechanism-is-a-bad-i...

"Most modern browsers have a “enhanced
privacy mode” that will remove the
referrer header next to refusing all
sorts of other tracking mechanisms,
which the header was initially
designed for."

mistydennis
Communicator

Very useful information - thanks so much!

0 Karma

DalJeanis
Legend

you're welcome!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...