https://community.splunk.com/t5/Getting-Data-In/Splunk-TA-Windows-Winregistry-Sourcetype-missing/m-p/490852#M83898 <P>All, </P> <P>Just working with Splunk_TA_Windows today and noticed that there is no specified sourcetype in inputs.conf and I don't see how the sourcetype is found in props.conf. Any idea how this is getting it's sourcetype? Would I be hurting anything to add it on? </P> <PRE><CODE>[WinRegMon://default] disabled = 1 hive = .* proc = .* type = rename|set|delete|create [WinRegMon://hkcu_run] disabled = 1 hive = \\REGISTRY\\USER\\.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename [WinRegMon://hklm_run] disabled = 1 hive = \\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename </CODE></PRE> Wed, 30 Sep 2020 03:05:29 GMT daniel333 2020-09-30T03:05:29Z https://community.splunk.com/t5/Getting-Data-In/Splunk-TA-Windows-Winregistry-Sourcetype-missing/m-p/490852#M83898 <P>All, </P> <P>Just working with Splunk_TA_Windows today and noticed that there is no specified sourcetype in inputs.conf and I don't see how the sourcetype is found in props.conf. Any idea how this is getting it's sourcetype? Would I be hurting anything to add it on? </P> <PRE><CODE>[WinRegMon://default] disabled = 1 hive = .* proc = .* type = rename|set|delete|create [WinRegMon://hkcu_run] disabled = 1 hive = \\REGISTRY\\USER\\.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename [WinRegMon://hklm_run] disabled = 1 hive = \\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename </CODE></PRE> Wed, 30 Sep 2020 03:05:29 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-TA-Windows-Winregistry-Sourcetype-missing/m-p/490852#M83898 daniel333 2020-09-30T03:05:29Z