https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552703#M65694 <P>thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/222210">@aasabatini</a>&nbsp;</P> Mon, 24 May 2021 07:33:27 GMT cabauah 2021-05-24T07:33:27Z https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552690#M65691 <P>Is there a quick query i can use to search which EC2 instance(s) are using a specific AMI for audit purposes</P> Mon, 24 May 2021 06:11:13 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552690#M65691 cabauah 2021-05-24T06:11:13Z https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552691#M65692 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/40615">@cabauah</a>&nbsp;</P><PRE><SPAN>source="*:ec2_instances" sourcetype="aws:description"</SPAN><BR /><SPAN>|</SPAN><SPAN>dedup</SPAN><SPAN> id </SPAN><SPAN>sortby</SPAN><SPAN> -_time</SPAN><BR /><SPAN>|</SPAN><SPAN>table</SPAN><SPAN> account_id region id, instance_type image_id ip_address state</SPAN><BR /><SPAN>|</SPAN><SPAN>sort</SPAN><SPAN> +state</SPAN></PRE> Mon, 24 May 2021 06:31:12 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552691#M65692 aasabatini 2021-05-24T06:31:12Z https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552703#M65694 <P>thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/222210">@aasabatini</a>&nbsp;</P> Mon, 24 May 2021 07:33:27 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/splunk-query-what-AWS-EC2-instance-is-using-specific-AMI-or-AMI/m-p/552703#M65694 cabauah 2021-05-24T07:33:27Z