https://community.splunk.com/t5/Getting-Data-In/Windows-TA-not-extracting-key-path-as-registry-path-from/m-p/640733#M109336 <P>Is it an omission that the latest Windows TA will only extract registry_path if the registry_type field contains "\w+Key". As a result, registry_path is not set to key_path and therefore in the Endpoint.Registry datamodel, there is no value stored for registry_path in the datamodel and the path comes out as unknown.</P><P>Has anyone come across a good reason NOT to add the additional mapping, so that it will pass through the DM correctly.</P><P>The consequence is that you can't use tstats on an accelerated DM</P> Thu, 20 Apr 2023 06:20:39 GMT bowesmana 2023-04-20T06:20:39Z https://community.splunk.com/t5/Getting-Data-In/Windows-TA-not-extracting-key-path-as-registry-path-from/m-p/640733#M109336 <P>Is it an omission that the latest Windows TA will only extract registry_path if the registry_type field contains "\w+Key". As a result, registry_path is not set to key_path and therefore in the Endpoint.Registry datamodel, there is no value stored for registry_path in the datamodel and the path comes out as unknown.</P><P>Has anyone come across a good reason NOT to add the additional mapping, so that it will pass through the DM correctly.</P><P>The consequence is that you can't use tstats on an accelerated DM</P> Thu, 20 Apr 2023 06:20:39 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-TA-not-extracting-key-path-as-registry-path-from/m-p/640733#M109336 bowesmana 2023-04-20T06:20:39Z