Hello, Team. For the past 24 hours, we have received roughly 7-8 alerts indicating internal machines/hosts/NAT IPs connecting to IP Address: 34.117.186.192 which do belong to ipinfo.io website (where this IP belongs to Google Cloud and has been reported to be malicious on forums). Splunk's proxy logs reveal frequently visited websites under the field "http_referrer" and under "values (url)" we see that , ipinfo/json*, ipinfo.io/?urls been displayed. Below are my asks: 1) What to "values(http_referrer) and "values (url)" repesent in Splunk Logs and Diff. b/w them in Investigations Checks. 2) Secondly, User visiting normal websites but why we are seeing always ipinfo/json*, ipinfo.io/?urls and such under "values (url)" field which are not browsed or accessed by users. (This was triggered on a rule mentioning Internal IP's connected multiple times to IP 34.117.186.192 and domain ipinfo.io. Could you please clarify on the ask why was ipinfo been seen here when users were not accessing it? Thank you! ... View more

Hello Everyone, I'm attempting to search for queries in Splunk Free Edition. However, it worked well for some time, and then I got the error "Search has been terminated." This is most likely due to a lack of recollection." This occurs rather frequently. I created a free AWS instance using the Linux platform. Please suggest any solutions for these problems. (I've included a screenshot for reference.)   ... View more