Splunk Search

Web Data Model no referrer

jacqu3sy
Path Finder

Can anyone help with the following please. Im looking to run a tstats query against the Web Data Model but exclude results where a user has been referrered to a destination.

If I run this directly against the index, it runs fine, but returns nothing when running it against the DM.

Query:

| tstats summariesonly count from datamodel=Web where Web.dest=kali AND Web.http_method=POST NOT Web.category="Web Ads/Analytics" NOT Web.http_user_agent="Mozilla/5.0 Zoom.App" NOT Web.http_referrer="*"

The other NOT statements work fine, but the NOT against Web.http_referrer just returns no results. I have tried using != instead of the NOT but I get the same problem.

Any ideas?

Tags (1)
0 Karma

sheamus69
Communicator

Looking at your query, I think the issue lies with the fact the the http_referrer field should be populated with something, even if it is "unknown", which I believe is what the datamodel autopopulates into an empty field. The code below should fix that?

| tstats summariesonly count from datamodel=Web where Web.dest=kali AND Web.http_method=POST NOT Web.category="Web Ads/Analytics" NOT Web.http_user_agent="Mozilla/5.0 Zoom.App" NOT Web.http_referrer="unknown"

jkat54
SplunkTrust
SplunkTrust

Yeah you could use this search to see too

| tstats values(http_referrer) from datamodel=Web

sheamus69
Communicator

Wouldn't that be

| tstats values(Web.http_referrer) from datamodel=Web

?

jkat54
SplunkTrust
SplunkTrust

Sure 🙂 ... my phone really doesn’t like it when I try typing that though. Was hoping someone would comment like you did.

0 Karma

sheamus69
Communicator

As a tangientially related query, any idea what generates that particular user agent?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is the datamodel accelerated? If not, tstats wont work because it only works on indexed fields within tsidx files.

0 Karma

jacqu3sy
Path Finder

yes its accelerated. It works fine. The only problem is excluding from the results URL's that people have been referred to.

I only want to see when people have browsed straight to the site in question rather than referrals which produces too much noise.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...