topic Re: REGISTRY QUERY in Getting Data In

REGISTRY QUERY

jip31jip31 — Thu, 12 Apr 2018 12:49:26 GMT

i try to query a registry key but Nothing is displayed
index="" sourcetype=WinRegistry key_path="\REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.*
could you bring me help please?

IN INPUT/
[WinRegMon://hkcu_run1]
disabled = 0
hive = \REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.
proc = .*
type = set|create|delete|rename
index = windows
thanks

Re: REGISTRY QUERY

logloganathan — Thu, 12 Apr 2018 13:19:41 GMT

Could you please try this query

index="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Master\ConfigurationCountry.*

Re: REGISTRY QUERY

jip31jip31 — Mon, 16 Apr 2018 06:00:12 GMT

now i use this request but Nothing is displayed.
index="" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Airbus\Master\ConfigurationCountry."
an idea please?

Re: REGISTRY QUERY

logloganathan — Wed, 18 Apr 2018 09:40:05 GMT

Could you please try only this query
ndex="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename

Re: REGISTRY QUERY

jip31jip31 — Wed, 18 Apr 2018 09:49:36 GMT

hI loglognathan Nothing is also displayed....

Re: REGISTRY QUERY

jip31jip31 — Wed, 18 Apr 2018 09:58:10 GMT

BUTut i got results Index="windows" sourcetype=WinRegistry

Re: REGISTRY QUERY

logloganathan — Wed, 18 Apr 2018 11:15:46 GMT

Could you please provide the SS of Index="windows" sourcetype=WinRegistry

or please provide the result sample

Re: REGISTRY QUERY

jip31jip31 — Tue, 29 Sep 2020 19:03:43 GMT

it works until :
index="" sourcetype="winregistry" key_path="\registry\user
but after un have an error message:
⚠ Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

Re: REGISTRY QUERY

p_gurav — Wed, 18 Apr 2018 12:08:08 GMT

After getting above data can you select the key_path from selected fields? Also can you try to find out Event Code 4657 ?

This doc may help:
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5a3187b4419202f0fb8b2dd1/1513195444728/Windows+Splunk+Logging+Cheat+Sheet+v2.2.pdf

Re: REGISTRY QUERY

logloganathan — Wed, 18 Apr 2018 12:58:59 GMT

Could you please share the search.log information