The actual input stanza in the Universal Forwarder for WinRegistry is: WinRegMon
Therefore, to disable WinRegistry input, please make changes to the following stanzas within
your etc/apps/Splunk_TA_windows/local/inputs.conf on your Windows Universal Forwarder(s) that
are sending out WinRegistry data to the indexers.
../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hklm_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename
../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://hkcu_run]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = \REGISTRY\USER\.\Software\Microsoft\Windows\CurrentVersion\Run\.
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = set|create|delete|rename
../etc/apps/Splunk_TA_windows/local/inputs.conf [WinRegMon://default]
../etc/apps/Splunk_TA_windows/local/inputs.conf disabled = 1
../etc/apps/Splunk_TA_windows/local/inputs.conf hive = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf index = windows
../etc/apps/Splunk_TA_windows/local/inputs.conf proc = .*
../etc/apps/Splunk_TA_windows/local/inputs.conf type = rename|set|delete|create
So basically 'disabled = 0' switches it on and 'disabled = 1' switches it off.
To stop WinRegistry set 'disabled = 1'.
I note on the Splunk Server 'splunk' it is already disabled within
etc/apps/Splunk_TA_windows/local/inputs.conf.
Please make the changes above then restart your universal forwarder.
