Solved: Re: splunk query what AWS EC2 instance is using sp... - Splunk Community

All Apps and Add-ons

Is there a quick query i can use to search which EC2 instance(s) are using a specific AMI for audit purposes

1 Solution

Solution

source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

thank you @aasabatini

Solution

source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars Sometimes, you just need to see the code. For those looking for a ...