topic .bash_history in Getting Data In

.bash_history

raiqbal47010 — Wed, 30 Sep 2020 05:25:20 GMT

I have multisite environment and I want to monitor all the ssh user commands through .bash_history.
for that purpose I enable the monitor:// stanza in all splunk components. interestingly, I am seeing bash_history logs from some servers and majority of the servers are not showing me logs whereas the same configuraiton is across the border.
please advise.

Re: .bash_history

PavelP — Fri, 15 May 2020 14:44:15 GMT

Hello @raiqbal47010

have you followed best practices for bash_history ingestion?

Based on this great post https://www.duanewaddle.com/splunking-bash-history/ by @dwaddle

https://github.com/duckfez/splunk-TA-bash_history

https://visibleninja.guru/splunking-bash-history/

Re: .bash_history

raiqbal47010 — Mon, 18 May 2020 11:40:32 GMT

I am getting below error on splunk instances:
not exporting configurations globally to system.
and seondly no commonds shown up when I press up arrown OR down arrow. even no history when i give history command. ?