Deployment Architecture

Bash History Logs

logtastic
Explorer

I've read all the suggestion on importing bash history logs and tried variation of fschange, followTail and ignoreOlderThan. 

For user logs this works just fine:

[monitor:///home/*/.bash_history]
disabled = false
sourcetype = bash_history
index = linux
followTail = 1
ignoreOlderThan = 1d

 

For root logs. Nothing works unless I monitor the whole file and that has no value to me since Splunk forwards the full log file each time a change occurs. So if the history size is 1000, then 1000 events are sent to splunk if I run a single "who" command. Any suggestions? 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...