Any idea on where I am going wrong with bash_histo...

daniel333 · ‎05-23-2018

All,

I am extracting bash_history, the event looks like this.

#1510170881
grep -r something *

But ends up with this timestamp
5/23/18 12:05:39.000 PM

I believe it should be
5/23/18 22:08:30.000 PM

My props.conf looks like this -

[bash_history]
 BREAK_ONLY_BEFORE = #(?=\d+)
 MAX_TIMESTAMP_LOOKAHEAD = 11
 SHOULD_LINEMERGE = true
 TIME_FORMAT = %s
 TIME_PREFIX = #
 TRANSFORMS-bashhistory = route_to_indexers

Any ideas where I might be going wrong with this?

richgalloway · ‎05-23-2018

Is the bash_history file in a different time zone from your Splunk account setting?

---
If this reply helps you, Karma would be appreciated.

Any idea on where I am going wrong with bash_history timestamping?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation