splunk query what AWS EC2 instance is using specific AMI or AMI version

[cabauah]

Is there a quick query i can use to search which EC2 instance(s) are using a specific AMI for audit purposes

[cabauah]

thank you @aasabatini 

[aasabatini · Accepted solution]

Hi @cabauah 

source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state