Splunk Search

In the top 10 values of the "http_referrer" field, why is the first value empty?

Communicator

I'm in the process of analyzing events in some of our download logs. When I click on "http_referrer" it brings up the top 10 values for this field, however the very first value is blank. This first value is significantly higher than the others, so I'm interested in where this traffic is coming from. What does a blank http_referrer field mean?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

According to this page over at stack overflow, http_referrer is an unreliable field. Blank means it wasn't filled in. in some cases, that means the browser was in a private window or otherwise had privacy enabled, in others it might indicate that the referring page just didn't care enough to code it.

http://stackoverflow.com/questions/6023941/how-reliable-is-http-referer

According to THIS page - https://gispunt.wordpress.com/2012/01/10/why-using-referer-header-as-a-security-mechanism-is-a-bad-i...

"Most modern browsers have a “enhanced
privacy mode” that will remove the
referrer header next to refusing all
sorts of other tracking mechanisms,
which the header was initially
designed for."

View solution in original post

SplunkTrust
SplunkTrust

According to this page over at stack overflow, http_referrer is an unreliable field. Blank means it wasn't filled in. in some cases, that means the browser was in a private window or otherwise had privacy enabled, in others it might indicate that the referring page just didn't care enough to code it.

http://stackoverflow.com/questions/6023941/how-reliable-is-http-referer

According to THIS page - https://gispunt.wordpress.com/2012/01/10/why-using-referer-header-as-a-security-mechanism-is-a-bad-i...

"Most modern browsers have a “enhanced
privacy mode” that will remove the
referrer header next to refusing all
sorts of other tracking mechanisms,
which the header was initially
designed for."

View solution in original post

Communicator

Very useful information - thanks so much!

0 Karma

SplunkTrust
SplunkTrust

you're welcome!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!