Adhoc search of bash_history files and attempting to just pull out listing of commands regardless of the timestamp value. I am not interested at this point in retrieving the Timestamp.
Here is what a given search returns:
Event 1 #1597921243 <-- Timestamp
whoami <-- Command whoami is returned as part of Event 1
Event 2 uname <-- Command uname is returned as a unique Event
Event 3 #1597921243 <-- Timestamp returned as unique event
Event 4 df -h <-- Command df -h is returned as a unique Event
Event 5 #1597678043 <-- Timestamp returned as unique event
When I execute this Search only Event 1 is returned which is Timestamp and separate line with whoami command
index=os sourcetype=bash_history host=my_host_name |regex "^#\d+\s+(?P<PGCMD>\w+)"
When I execute this Search 3 Events are returned, Event 1 (TS + whoami) and Event 2 (uname) and Event 4 (df)
index=os sourcetype=bash_history host=my_host_name |regex "[a-zA-Z]+"
When I execute this Search 2 Events are returned, Event 2 (uname) and Event 4 (df)
index=os sourcetype=bash_history host=ps2pr608661 |regex "^\w+"
What I am trying to end up with is just viewing the commands, no time stamps, in essence results should just be whoami, uname and df -h nothing else
I've been searching for a solution but 1.5 days into this I cannot find one. Any help is appreciated
