Getting Data In

Excluding a process from regmon on Windows

kogane
Path Finder

Is there a way to configure regmon-filters.conf such that it captures all Windows registry changes, EXCEPT for one or more processes? For example, capture everything except changes by splunkd.exe.

Tags (2)
1 Solution

kogane
Path Finder

Splunk Support came up with a regex that works:

proc = ^(?:(?!ExeNameGoesHere).)*$

View solution in original post

kogane
Path Finder

Splunk Support came up with a regex that works:

proc = ^(?:(?!ExeNameGoesHere).)*$

piebob
Splunk Employee
Splunk Employee

for context, please see the other Answer to this question.

0 Karma

lukejadamec
Super Champion

Yes. See this document, and be sure to select the your Splunk version in the upper right.
http://docs.splunk.com/Documentation/Splunk/5.0.5/admin/Regmon-filtersconf

Generally speaking, to exclude splunkd.exe you add a custom stanza at the global level and include a regular expression EXCEPT for splunkd.exe for the proc attribute. The way the proc filter works to send everything that matches through, and it drops everything that does not match.

kogane
Path Finder

no luck yet... opened a support case

0 Karma

lukejadamec
Super Champion

proc = ^\(?!splunk\.exe).*$

0 Karma

kogane
Path Finder

I've gone through a few, but here's the latest one I got from someone at Splunk:

proc = (.(?!\splunkd.exe).)

There are stars after the dots, but they aren't showing up in the comment.

0 Karma

lukejadamec
Super Champion

What is your regex?

0 Karma

kogane
Path Finder

I've seen the docs. A negative regular expression does not seem to have any impact. Is it supposed to work?

0 Karma

piebob
Splunk Employee
Splunk Employee

this assumes you are using a version of splunk older than 6.0. if you're using 6.0, the same procedure applies, but all the changes should be made in a local copy of inputs.conf

see http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorWindowsregistrydata#Filter_incoming_Regi...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...