https://community.splunk.com/t5/Getting-Data-In/Any-idea-on-where-I-am-going-wrong-with-bash-history/m-p/416614#M73580 <P>All, </P> <P>I am extracting bash_history, the event looks like this. </P> <PRE><CODE>#1510170881 grep -r something * </CODE></PRE> <P>But ends up with this timestamp<BR /> 5/23/18 12:05:39.000 PM</P> <P>I believe it should be <BR /> 5/23/18 22:08:30.000 PM</P> <P>My props.conf looks like this - </P> <PRE><CODE>[bash_history] BREAK_ONLY_BEFORE = #(?=\d+) MAX_TIMESTAMP_LOOKAHEAD = 11 SHOULD_LINEMERGE = true TIME_FORMAT = %s TIME_PREFIX = # TRANSFORMS-bashhistory = route_to_indexers </CODE></PRE> <P>Any ideas where I might be going wrong with this? </P> Wed, 23 May 2018 22:19:08 GMT daniel333 2018-05-23T22:19:08Z https://community.splunk.com/t5/Getting-Data-In/Any-idea-on-where-I-am-going-wrong-with-bash-history/m-p/416614#M73580 <P>All, </P> <P>I am extracting bash_history, the event looks like this. </P> <PRE><CODE>#1510170881 grep -r something * </CODE></PRE> <P>But ends up with this timestamp<BR /> 5/23/18 12:05:39.000 PM</P> <P>I believe it should be <BR /> 5/23/18 22:08:30.000 PM</P> <P>My props.conf looks like this - </P> <PRE><CODE>[bash_history] BREAK_ONLY_BEFORE = #(?=\d+) MAX_TIMESTAMP_LOOKAHEAD = 11 SHOULD_LINEMERGE = true TIME_FORMAT = %s TIME_PREFIX = # TRANSFORMS-bashhistory = route_to_indexers </CODE></PRE> <P>Any ideas where I might be going wrong with this? </P> Wed, 23 May 2018 22:19:08 GMT https://community.splunk.com/t5/Getting-Data-In/Any-idea-on-where-I-am-going-wrong-with-bash-history/m-p/416614#M73580 daniel333 2018-05-23T22:19:08Z https://community.splunk.com/t5/Getting-Data-In/Any-idea-on-where-I-am-going-wrong-with-bash-history/m-p/416615#M73581 <P>Is the bash_history file in a different time zone from your Splunk account setting?</P> Wed, 23 May 2018 23:00:52 GMT https://community.splunk.com/t5/Getting-Data-In/Any-idea-on-where-I-am-going-wrong-with-bash-history/m-p/416615#M73581 richgalloway 2018-05-23T23:00:52Z