get_ec2_details_by_instance_id.json

{
  "creation_date": "2018-02-12",
  "data_metadata": {
    "data_source": [
      "AWS Description"
    ],
    "data_sourcetypes": [
      "aws:description"
    ],
    "providing_technologies": [
      "AWS"
    ]
  },
  "description": "This search queries AWS description logs and returns all the information about a specific instance via the instanceId field",
  "entities": [
    "instanceId"
  ],
  "how_to_implement": "In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs.",
  "id": "f3db4d1b-5f33-4b01-c541-c7ah9514c242",
  "investigate": {
    "splunk": {
      "fields_required": [
        "instanceId"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "86400",
        "latest_time": "0"
      },
      "search": "| search sourcetype=\"aws:description\" source=\"*:ec2_instances\"| dedup id sortby -_time | search id={instanceId} | spath output=tags path=tags | eval tags=mvzip(key,value,\" = \"), ip_address=if((ip_address == \"null\"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as \"Account ID\", id as ID, instance_type as Type, ip_address as \"IP Address\", key_name as \"Key Pair\", launch_time as \"Launch Time\", placement as \"Availability Zone\", state as State, subnet_id as Subnet, \"tags.Name\" as Name, vpc_id as VPC"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2018-02-12",
  "name": "Get EC2 Instance Details by instanceId",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}