Search bash_history

[p544gm]

Adhoc search of bash_history files and attempting to just pull out listing of commands regardless of the timestamp value. I am not interested at this point in retrieving the Timestamp.

Here is what a given search returns:

Event 1 #1597921243 <-- Timestamp
whoami                               <-- Command whoami is returned as part of Event 1
Event 2 uname                 <-- Command uname is returned as a unique Event
Event 3 #1597921243 <-- Timestamp returned as unique event
Event 4 df -h                      <-- Command df -h is returned as a unique Event
Event 5 #1597678043 <-- Timestamp returned as unique event

When I execute this Search only Event 1 is returned which is Timestamp and separate line with whoami command

index=os sourcetype=bash_history host=my_host_name |regex "^#\d+\s+(?P<PGCMD>\w+)"

When I execute this Search 3 Events are returned, Event 1 (TS + whoami) and Event 2 (uname) and Event 4 (df)

index=os sourcetype=bash_history host=my_host_name |regex "[a-zA-Z]+"

When I execute this Search 2 Events are returned, Event 2 (uname) and Event 4 (df)

index=os sourcetype=bash_history host=ps2pr608661 |regex "^\w+"

What I am trying to end up with is just viewing the commands, no time stamps, in essence results should just be whoami, uname and df -h nothing else

I've been searching for a solution but 1.5 days into this I cannot find one. Any help is appreciated

[ITWhisperer · Accepted solution]

| rex field=_raw mode=sed "s/^#\d+\s?//g"
| where _raw!=""

[p544gm]

fantastic! worked like a charm. Was unaware I could use sed. It's a good day when you learn something new! Thank you for quick reply and solution.