I would like to disable WinRegistry from the Windows App/Add-on from Indexing as the license has been exceeded

[christopherr_sp]

I am using the Windows App/Add-on for Windows and would like to stop WinRegistry indexing
as I have exceeded my license limit.

splunk_app_windows_infrastructure 1.4.4
Splunk_TA_windows 4.8.4

[christopherr_sp · Accepted solution]

The actual input stanza in the Universal Forwarder for WinRegistry is: WinRegMon

Therefore, to disable WinRegistry input, please make changes to the following stanzas within
your etc/apps/Splunk_TA_windows/local/inputs.conf on your Windows Universal Forwarder(s) that
are sending out WinRegistry data to the indexers.

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hklm_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hkcu_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\USER\.\Software\Microsoft\Windows\CurrentVersion\Run\.
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename

../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://default]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = rename|set|delete|create

So basically 'disabled = 0' switches it on and 'disabled = 1' switches it off.

To stop WinRegistry set 'disabled = 1'.

I note on the Splunk Server 'splunk' it is already disabled within
etc/apps/Splunk_TA_windows/local/inputs.conf.

Please make the changes above then restart your universal forwarder.