check who is ingesting data to index=main

Path Finder

is there a way on how to check who is ingesting data to index=main
I want to know list of source, sourcetype,host for the data and check hosts/data belongs to which team

Tags (1)
0 Karma

Esteemed Legend

Like this:

| tstats max(_indextime) AS _time first(source) WHERE index=main BY host sourcetype



If you have access to license usage logs then it will be good start to checking those logs. You can use below query to check license usage of main index which will give you Host, Source, Sourcetype

index=_internal source=*license_usage.log* idx=main | stats sum(b) As Bytes by h,s,st,idx | rename h AS Host, s AS Source, st AS Sourcetype, idx AS Index | table Host,Source,Sourcetype,Index,Bytes
0 Karma

Ultra Champion

Try this:

index=main |stats last(sourcetype) by source host
0 Karma