https://community.splunk.com/t5/Getting-Data-In/WinRegMon-proc-regex-not-working/m-p/503821#M85927 <P>Hi all,</P><P>Have a distributed Splunk Enterprise deployment. I am trying to filter incoming registry events to remove wasteful data on all of my Forwarders. This is the Stanza in question from $SPLUNK_HOME\etc\deployment_apps\Splunk_TA_Windows\local\inputs.conf. This app is deployed to all appropriate Forwarders and have run 'reload deploy-server' after saving changes.</P><LI-CODE lang="markup">[WinRegMon://hklm] disabled = 0 hive = \\REGISTRY\\MACHINE\\.* proc = ^(?:(?!first\.exe|Second\.Punctuated\.exe).)*$ type = create|delete index = windows-mon</LI-CODE><P>&nbsp;When watching incoming data, the regex isn't working, events containing these exe names in process_image are still present. I have checked using regex101.com using example data below, it works perfectly.</P><LI-CODE lang="markup">06/11/2020 08:51:57.983 event_status="(0)The operation completed successfully." pid=1996 process_image="c:\Program Files\Folder\first.exe" registry_type="CreateKey" key_path="HKLM\software\folder\classifiedapplications" data_type="REG_NONE" data="" 06/11/2020 08:53:18.187 event_status="(0)The operation completed successfully." pid=2084 process_image="c:\Program Files (x86)\Folder\Second.Punctuated.exe" registry_type="CreateKey" key_path="HKLM\software\microsoft\enterprisecertificates\trust\ctls" data_type="REG_NONE" data=""</LI-CODE><P>&nbsp;What am I doing wrong?</P> Wed, 10 Jun 2020 22:57:35 GMT bdaniel 2020-06-10T22:57:35Z https://community.splunk.com/t5/Getting-Data-In/WinRegMon-proc-regex-not-working/m-p/503821#M85927 <P>Hi all,</P><P>Have a distributed Splunk Enterprise deployment. I am trying to filter incoming registry events to remove wasteful data on all of my Forwarders. This is the Stanza in question from $SPLUNK_HOME\etc\deployment_apps\Splunk_TA_Windows\local\inputs.conf. This app is deployed to all appropriate Forwarders and have run 'reload deploy-server' after saving changes.</P><LI-CODE lang="markup">[WinRegMon://hklm] disabled = 0 hive = \\REGISTRY\\MACHINE\\.* proc = ^(?:(?!first\.exe|Second\.Punctuated\.exe).)*$ type = create|delete index = windows-mon</LI-CODE><P>&nbsp;When watching incoming data, the regex isn't working, events containing these exe names in process_image are still present. I have checked using regex101.com using example data below, it works perfectly.</P><LI-CODE lang="markup">06/11/2020 08:51:57.983 event_status="(0)The operation completed successfully." pid=1996 process_image="c:\Program Files\Folder\first.exe" registry_type="CreateKey" key_path="HKLM\software\folder\classifiedapplications" data_type="REG_NONE" data="" 06/11/2020 08:53:18.187 event_status="(0)The operation completed successfully." pid=2084 process_image="c:\Program Files (x86)\Folder\Second.Punctuated.exe" registry_type="CreateKey" key_path="HKLM\software\microsoft\enterprisecertificates\trust\ctls" data_type="REG_NONE" data=""</LI-CODE><P>&nbsp;What am I doing wrong?</P> Wed, 10 Jun 2020 22:57:35 GMT https://community.splunk.com/t5/Getting-Data-In/WinRegMon-proc-regex-not-working/m-p/503821#M85927 bdaniel 2020-06-10T22:57:35Z