Monitoring Splunk

I'm getting GetDriverHandle: Unable to install driver. Errors...

Genti
Splunk Employee
Splunk Employee

"Hi support
I am receiving a lot of these messages in my light forwarder's splunkd.log
06-29-2010 14:27:05.615 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-regmon.exe" --driver-path "C:\Program Files\Splunk\bin"" splunk-regmon - GetDriverHandle: Unable to install driver.

Why is this happening and how do i remove them?"

Tags (1)
1 Solution

Genti
Splunk Employee
Splunk Employee

So the issue of the driver signature has come up before.
Im not too sure why it happens but one possibility is with 64bit machines and the driver not passing the signing. Another possibility is if you already have one instance of splunk running and the regmon is already being monitored.

Since this is a light forwarder then you cannot use splunkweb to disable the monitoring. What is needed is to change this in the configuration files: Go to C:\Program Files\Splunk\etc\system\local\inputs.conf

And add this:

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 1

Once done, a splunk restart is all that is needed.
Cheers
.gz

View solution in original post

Genti
Splunk Employee
Splunk Employee

So the issue of the driver signature has come up before.
Im not too sure why it happens but one possibility is with 64bit machines and the driver not passing the signing. Another possibility is if you already have one instance of splunk running and the regmon is already being monitored.

Since this is a light forwarder then you cannot use splunkweb to disable the monitoring. What is needed is to change this in the configuration files: Go to C:\Program Files\Splunk\etc\system\local\inputs.conf

And add this:

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 1

Once done, a splunk restart is all that is needed.
Cheers
.gz

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...