How to do it...

Follow these steps to search for the top-referring websites:

1. Log in to your Splunk server.
2. Select the Search & Reporting application.
3. Ensure that the time range picker is set to Last 24 hours and type the following search into the Splunk search bar. Then, click on Search or hit Enter:

index=main sourcetype=access_combined | stats dc(clientip) AS Referals by referer_domain | sort - Referals

1. Splunk will return a tabulated list ordered by the number of unique referrals each website has provided, as shown in the following screenshot:
   
2. Save this search by clicking on Save As and then on Report. Give the report a name of cp02_top_referring_websites and click on Save. On the next screen, click on Continue Editing to return to the search.