topic Re: Disable loading of splunk-regmon in Getting Data In

Disable loading of splunk-regmon

Derek — Wed, 30 Jun 2010 02:14:45 GMT

Hi,

How can I stop the loading of splunk-regmon?

I'm getting these errors:

ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-regmon.exe" --driver-path "C:\Program Files\Splunk\bin"" splunk-regmon - GetDriverHandle: Unable to install driver.

ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-regmon.exe" --driver-path "C:\Program Files\Splunk\bin"" splunk-regmon - run_regmon: Failed to initialize Registry Monitor

I've tried to troubleshoot Antivirus etc but with no luck.

Thanks!

Re: Disable loading of splunk-regmon

Genti — Wed, 30 Jun 2010 03:05:19 GMT

Derek,

If i remember correctly this is a bug that Splunk developers are working on. If memory serves right, this does not interfere with your daily splunk usage and performance and you should not worry about it

.gz

Re: Disable loading of splunk-regmon

Derek — Wed, 30 Jun 2010 03:09:31 GMT

Thanks for the info. I've only noticed this happen on one machine out of many so far. Is this a bug in 4.1.x?

Re: Disable loading of splunk-regmon

Genti — Wed, 30 Jun 2010 03:25:27 GMT

btw, you can still disable that if you would like to.
Just go to: manager > data inputs > script and disable the "splunk-regmon.path"
This way at least you wont be bothered by those msg's

Re: Disable loading of splunk-regmon

Derek — Wed, 30 Jun 2010 07:40:53 GMT

If you don't have access to Splunk Web then in inputs.conf (etc/system/local) add:

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 1