All Apps and Add-ons

I would like to disable WinRegistry from the Windows App/Add-on from Indexing as the license has been exceeded

christopherr_sp
Splunk Employee
Splunk Employee

I am using the Windows App/Add-on for Windows and would like to stop WinRegistry indexing
as I have exceeded my license limit.

splunk_app_windows_infrastructure 1.4.4
Splunk_TA_windows 4.8.4

0 Karma
1 Solution

christopherr_sp
Splunk Employee
Splunk Employee

The actual input stanza in the Universal Forwarder for WinRegistry is: WinRegMon

Therefore, to disable WinRegistry input, please make changes to the following stanzas within
your etc/apps/Splunk_TA_windows/local/inputs.conf on your Windows Universal Forwarder(s) that
are sending out WinRegistry data to the indexers.

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hklm_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hkcu_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\USER\.\Software\Microsoft\Windows\CurrentVersion\Run\.
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://default]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = rename|set|delete|create

So basically 'disabled = 0' switches it on and 'disabled = 1' switches it off.

To stop WinRegistry set 'disabled = 1'.

I note on the Splunk Server 'splunk' it is already disabled within
etc/apps/Splunk_TA_windows/local/inputs.conf.

Please make the changes above then restart your universal forwarder.

View solution in original post

0 Karma

christopherr_sp
Splunk Employee
Splunk Employee

The actual input stanza in the Universal Forwarder for WinRegistry is: WinRegMon

Therefore, to disable WinRegistry input, please make changes to the following stanzas within
your etc/apps/Splunk_TA_windows/local/inputs.conf on your Windows Universal Forwarder(s) that
are sending out WinRegistry data to the indexers.

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hklm_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hkcu_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\USER\.\Software\Microsoft\Windows\CurrentVersion\Run\.
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://default]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = rename|set|delete|create

So basically 'disabled = 0' switches it on and 'disabled = 1' switches it off.

To stop WinRegistry set 'disabled = 1'.

I note on the Splunk Server 'splunk' it is already disabled within
etc/apps/Splunk_TA_windows/local/inputs.conf.

Please make the changes above then restart your universal forwarder.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!