Is there a quick query i can use to search which EC2 instance(s) are using a specific AMI for audit purposes
Hi @cabauah
source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state
thank you @aasabatini
Hi @cabauah
source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state