Solved: splunk query what AWS EC2 instance is using specif... - Splunk Community

All Apps and Add-ons

Is there a quick query i can use to search which EC2 instance(s) are using a specific AMI for audit purposes

1 Solution

Solution

source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

thank you @aasabatini

Solution

source="*:ec2_instances" sourcetype="aws:description"
|dedup id sortby -_time
|table account_id region id, instance_type image_id ip_address state
|sort +state

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...