Getting Data In

Excluding a process from regmon on Windows

Path Finder

Is there a way to configure regmon-filters.conf such that it captures all Windows registry changes, EXCEPT for one or more processes? For example, capture everything except changes by splunkd.exe.

Tags (2)
1 Solution

Path Finder

Splunk Support came up with a regex that works:

proc = ^(?:(?!ExeNameGoesHere).)*$

View solution in original post

Path Finder

Splunk Support came up with a regex that works:

proc = ^(?:(?!ExeNameGoesHere).)*$

View solution in original post

Splunk Employee
Splunk Employee

for context, please see the other Answer to this question.

0 Karma

Super Champion

Yes. See this document, and be sure to select the your Splunk version in the upper right.
http://docs.splunk.com/Documentation/Splunk/5.0.5/admin/Regmon-filtersconf

Generally speaking, to exclude splunkd.exe you add a custom stanza at the global level and include a regular expression EXCEPT for splunkd.exe for the proc attribute. The way the proc filter works to send everything that matches through, and it drops everything that does not match.

Path Finder

no luck yet... opened a support case

0 Karma

Super Champion

proc = ^\(?!splunk\.exe).*$

0 Karma

Path Finder

I've gone through a few, but here's the latest one I got from someone at Splunk:

proc = (.(?!\splunkd.exe).)

There are stars after the dots, but they aren't showing up in the comment.

0 Karma

Super Champion

What is your regex?

0 Karma

Path Finder

I've seen the docs. A negative regular expression does not seem to have any impact. Is it supposed to work?

0 Karma

Splunk Employee
Splunk Employee

this assumes you are using a version of splunk older than 6.0. if you're using 6.0, the same procedure applies, but all the changes should be made in a local copy of inputs.conf

see http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorWindowsregistrydata#Filter_incoming_Regi...

0 Karma