https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/266943#M51130 <P>Hello!</P> <P>I need some help filtering Windows registry events in Splunk. Here is my inputs.conf file</P> <PRE><CODE>[WinRegMon://default] disabled = 0 hive = .* proc = .(?!symantec|google)([a-z0-9*]+)$ type = rename|set|delete|create index = windows </CODE></PRE> <P>As you can see in proc, I am trying to remove all entries which have the word sDymantec and google, but I have had no success.</P> <P>Could anyone provide a way they are doing this or a suggestion?</P> <P>Thank you!</P> Wed, 20 Jul 2016 16:53:29 GMT lelandtheg 2016-07-20T16:53:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/266943#M51130 <P>Hello!</P> <P>I need some help filtering Windows registry events in Splunk. Here is my inputs.conf file</P> <PRE><CODE>[WinRegMon://default] disabled = 0 hive = .* proc = .(?!symantec|google)([a-z0-9*]+)$ type = rename|set|delete|create index = windows </CODE></PRE> <P>As you can see in proc, I am trying to remove all entries which have the word sDymantec and google, but I have had no success.</P> <P>Could anyone provide a way they are doing this or a suggestion?</P> <P>Thank you!</P> Wed, 20 Jul 2016 16:53:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/266943#M51130 lelandtheg 2016-07-20T16:53:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/266944#M51131 <P>needed to do the same today. this seems to work for me.</P> <PRE><CODE>proc = ^((?!(reg.exe|powershell_ise.exe)).)*$ </CODE></PRE> Fri, 03 Feb 2017 01:36:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/266944#M51131 dstaulcu 2017-02-03T01:36:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/680854#M113752 <P>I've been working on an issue where I need to be able to filter out a registry entry as well, but this solution doesn't get me there.&nbsp; &nbsp;I need to filter out the languagelist entry, just can't get the regex to work. Anyone else have success filtering reg entries?<BR /><BR />I need to filter out this entry.</P> <LI-CODE lang="markup">HKU\.default\software\classes\local settings\muicache\2c4\52c64b7e\languagelist</LI-CODE> Fri, 15 Mar 2024 17:40:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-edit-my-WinRegMon-configuration-to-filter-out-certain/m-p/680854#M113752 mikefg 2024-03-15T17:40:52Z