[Bro] Bro script derived off of the referrer

[Brian Chilton]

All, I am attempting to write a script that will key off of when the referrer is empty.  The problem with that right now is that when I do this I have to use c$http$referrer == "-" which it does not like as an actual value.  Is there another way to do this?  I tried escaping it with a \ but that didn't seem to work either.  Any assistance you and provide would be great. also, does anyone know where I can get some more info on the input framework? Thanks, BC 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150421/e0d77eb7/attachment.html