https://community.splunk.com/t5/Splunk-Search/What-is-splunkdrv/m-p/38091#M178698 <P>Can anyone explain the purpose and function of the "splunkdrv" Windows service? It appears as though this is some kind of kernel-mode driver. I'm curious what Splunk needs to do in kernel-mode that couldn't be done at user-level.</P> Fri, 27 Apr 2012 14:26:30 GMT Lowell 2012-04-27T14:26:30Z https://community.splunk.com/t5/Splunk-Search/What-is-splunkdrv/m-p/38091#M178698 <P>Can anyone explain the purpose and function of the "splunkdrv" Windows service? It appears as though this is some kind of kernel-mode driver. I'm curious what Splunk needs to do in kernel-mode that couldn't be done at user-level.</P> Fri, 27 Apr 2012 14:26:30 GMT https://community.splunk.com/t5/Splunk-Search/What-is-splunkdrv/m-p/38091#M178698 Lowell 2012-04-27T14:26:30Z https://community.splunk.com/t5/Splunk-Search/What-is-splunkdrv/m-p/38092#M178699 <P>splunkdrv is kernel mode filter driver for Windows registry. Essentially it allows Splunk to listen to every call to registry and log it as a registry event. Windows implements its driver framework such that it allows such lightweight filter drivers to be plugged into existing drivers such as registry file system, etc. </P> Mon, 30 Apr 2012 18:01:16 GMT https://community.splunk.com/t5/Splunk-Search/What-is-splunkdrv/m-p/38092#M178699 rovechkin_splun 2012-04-30T18:01:16Z