topic check who is ingesting data to index=main in Getting Data In

check who is ingesting data to index=main

Mohsin123 — Thu, 07 Dec 2017 08:37:00 GMT

is there a way on how to check who is ingesting data to index=main
I want to know list of source, sourcetype,host for the data and check hosts/data belongs to which team

Re: check who is ingesting data to index=main

nickhills — Thu, 07 Dec 2017 08:46:47 GMT

Try this:

index=main |stats last(sourcetype) by source host

Re: check who is ingesting data to index=main

harsmarvania57 — Thu, 07 Dec 2017 08:47:13 GMT

Hi,

If you have access to license usage logs then it will be good start to checking those logs. You can use below query to check license usage of main index which will give you Host, Source, Sourcetype

index=_internal source=*license_usage.log* idx=main | stats sum(b) As Bytes by h,s,st,idx | rename h AS Host, s AS Source, st AS Sourcetype, idx AS Index | table Host,Source,Sourcetype,Index,Bytes

Re: check who is ingesting data to index=main

woodcock — Thu, 07 Dec 2017 19:49:17 GMT

Like this:

| tstats max(_indextime) AS _time first(source) WHERE index=main BY host sourcetype