Getting Data In

check who is ingesting data to index=main

Path Finder

is there a way on how to check who is ingesting data to index=main
I want to know list of source, sourcetype,host for the data and check hosts/data belongs to which team

Tags (1)
0 Karma

Esteemed Legend

Like this:

| tstats max(_indextime) AS _time first(source) WHERE index=main BY host sourcetype



If you have access to license usage logs then it will be good start to checking those logs. You can use below query to check license usage of main index which will give you Host, Source, Sourcetype

index=_internal source=*license_usage.log* idx=main | stats sum(b) As Bytes by h,s,st,idx | rename h AS Host, s AS Source, st AS Sourcetype, idx AS Index | table Host,Source,Sourcetype,Index,Bytes
0 Karma

Ultra Champion

Try this:

index=main |stats last(sourcetype) by source host
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...