is there a way on how to check who is ingesting data to index=main
I want to know list of source, sourcetype,host for the data and check hosts/data belongs to which team
Like this:
| tstats max(_indextime) AS _time first(source) WHERE index=main BY host sourcetype
Hi,
If you have access to license usage logs then it will be good start to checking those logs. You can use below query to check license usage of main
index which will give you Host, Source, Sourcetype
index=_internal source=*license_usage.log* idx=main | stats sum(b) As Bytes by h,s,st,idx | rename h AS Host, s AS Source, st AS Sourcetype, idx AS Index | table Host,Source,Sourcetype,Index,Bytes
Try this:
index=main |stats last(sourcetype) by source host