I am having trouble extracting certain information from registry events. For example I want to extract the "SetValue" from the registry type, however, when I try to use the "extract fields" option to create to create a field for it, Splunk does not allow me to select that specific string to create the field. Is there a way to fix this? Or an alternative method to create fields for registrytype and also keypath and process_image?
eventstatus="(0)The operation completed successfully."
Hi Adonio I am using the TA for Windows and I also followed the doc, however my events still do not look like the ones you have in the screen shot. This is the monitor I am using, not sure if it aligns with the one you are using.
disabled = 0
hive = \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.*
proc = .*
index = windows
type = rename|set|create|delete|rename
Also, do you think I need to make any changes or configs to any other file? In order to get all the other events to come in properly?