https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140014#M38576 <P>What would be the syntax to search for registry key creation?</P> Thu, 09 Apr 2015 19:27:06 GMT Barty001 2015-04-09T19:27:06Z https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140014#M38576 <P>What would be the syntax to search for registry key creation?</P> Thu, 09 Apr 2015 19:27:06 GMT https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140014#M38576 Barty001 2015-04-09T19:27:06Z https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140015#M38577 <P>Hi Barty001<BR /> which creation ? please let me known</P> Thu, 09 Apr 2015 20:17:08 GMT https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140015#M38577 chimell 2015-04-09T20:17:08Z https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140016#M38578 <P>You need to explicitly enable auditing for the key you want to watch (google windows registry auditing); after that, you will see events in your windows event log (which you will need to forward to your splunk instance). If I am not mistaken, those would be events with the id 4657, so a search could look something like this:<BR /> <CODE>index = wineventlog | 4657</CODE></P> Fri, 10 Apr 2015 11:17:45 GMT https://community.splunk.com/t5/Splunk-Search/What-would-be-the-syntax-to-search-for-registry-key-creation/m-p/140016#M38578 jeffland 2015-04-10T11:17:45Z