https://community.splunk.com/t5/Getting-Data-In/WinRegMon-Blacklist-specific-Registry-Hive/m-p/473730#M81354 <P>blacklist1 is for event logs, not registry monitoring. You could change your hive regex to exclude the unwanted path but include the others.</P> Mon, 24 Feb 2020 17:01:58 GMT spayneort 2020-02-24T17:01:58Z https://community.splunk.com/t5/Getting-Data-In/WinRegMon-Blacklist-specific-Registry-Hive/m-p/473729#M81353 <P>Hi,</P> <P>i currently use the WinRegMon Stanza within the inputs.conf. Currently i monitor all changes within the User Software Hive. But there is one Path that i want to exclude. So i tried using the blacklist feature, but it didnt work. See my config attached:</P> <P>hive = \REGISTRY\USER\.<EM>\Software\\?.</EM><BR /> blacklist1 = \REGISTRY\USER\.<EM>\Software\Classes\.</EM>\MuiCache\\?.*<BR /> proc=.*</P> <P>That blacklist doesnt work - can someone spot the failure? </P> <P>Thanks in advance</P> Tue, 18 Feb 2020 15:34:40 GMT https://community.splunk.com/t5/Getting-Data-In/WinRegMon-Blacklist-specific-Registry-Hive/m-p/473729#M81353 DanielAmlung 2020-02-18T15:34:40Z https://community.splunk.com/t5/Getting-Data-In/WinRegMon-Blacklist-specific-Registry-Hive/m-p/473730#M81354 <P>blacklist1 is for event logs, not registry monitoring. You could change your hive regex to exclude the unwanted path but include the others.</P> Mon, 24 Feb 2020 17:01:58 GMT https://community.splunk.com/t5/Getting-Data-In/WinRegMon-Blacklist-specific-Registry-Hive/m-p/473730#M81354 spayneort 2020-02-24T17:01:58Z