check who is ingesting data to index=main

[Mohsin123]

is there a way on how to check who is ingesting data to index=main
I want to know list of source, sourcetype,host for the data and check hosts/data belongs to which team

[woodcock]

Like this:

| tstats max(_indextime) AS _time first(source) WHERE index=main BY host sourcetype

[harsmarvania57]

Hi,

If you have access to license usage logs then it will be good start to checking those logs. You can use below query to check license usage of main index which will give you Host, Source, Sourcetype

index=_internal source=*license_usage.log* idx=main | stats sum(b) As Bytes by h,s,st,idx | rename h AS Host, s AS Source, st AS Sourcetype, idx AS Index | table Host,Source,Sourcetype,Index,Bytes

[nickhills]

Try this:

index=main |stats last(sourcetype) by source host