@zwass yes, so if I created a pack to track users shell_history and set it up with splunk. It would update the log file per predefined interval right? Or is there a way to make it update in real time?