Search bash_history

p544gm — Tue, 15 Sep 2020 15:49:43 GMT

Adhoc search of bash_history files and attempting to just pull out listing of commands regardless of the timestamp value. I am not interested at this point in retrieving the Timestamp.

Here is what a given search returns:

Event 1 #1597921243 <-- Timestamp
whoami <-- Command whoami is returned as part of Event 1
Event 2 uname <-- Command uname is returned as a unique Event
Event 3 #1597921243 <-- Timestamp returned as unique event
Event 4 df -h <-- Command df -h is returned as a unique Event
Event 5 #1597678043 <-- Timestamp returned as unique event

When I execute this Search only Event 1 is returned which is Timestamp and separate line with whoami command

index=os sourcetype=bash_history host=my_host_name |regex "^#\d+\s+(?P<PGCMD>\w+)"

When I execute this Search 3 Events are returned, Event 1 (TS + whoami) and Event 2 (uname) and Event 4 (df)

index=os sourcetype=bash_history host=my_host_name |regex "[a-zA-Z]+"

When I execute this Search 2 Events are returned, Event 2 (uname) and Event 4 (df)

index=os sourcetype=bash_history host=ps2pr608661 |regex "^\w+"

What I am trying to end up with is just viewing the commands, no time stamps, in essence results should just be whoami, uname and df -h nothing else

I've been searching for a solution but 1.5 days into this I cannot find one. Any help is appreciated

Re: Search bash_history

ITWhisperer — Tue, 15 Sep 2020 16:04:15 GMT

| rex field=_raw mode=sed "s/^#\d+\s?//g" | where _raw!=""

Re: Search bash_history

p544gm — Tue, 15 Sep 2020 16:17:17 GMT

fantastic! worked like a charm. Was unaware I could use sed. It's a good day when you learn something new! Thank you for quick reply and solution.

topic Re: Search bash_history in Splunk Search

Search bash_history

Re: Search bash_history

Re: Search bash_history