REGISTRY QUERY

[jip31jip31]

hi

i try to query a registry key but Nothing is displayed
index="" sourcetype=WinRegistry key_path="\REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.*
could you bring me help please?

IN INPUT/
[WinRegMon://hkcu_run1]
disabled = 0
hive = \REGISTRY\USER\.\Software\WOW6432Node\Master\ConfigurationCountry\.
proc = .*
type = set|create|delete|rename
index = windows
thanks

[jip31jip31]

it works until :
index="" sourcetype="winregistry" key_path="\registry\user
but after un have an error message:
⚠ Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

[logloganathan]

Could you please share the search.log information

[jip31jip31]

BUTut i got results Index="windows" sourcetype=WinRegistry

[p_gurav]

After getting above data can you select the key_path from selected fields? Also can you try to find out Event Code 4657 ?

This doc may help:
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5a3187b4419202f0fb8b2dd1/151319544...

[jip31jip31]

hI loglognathan Nothing is also displayed....

[logloganathan]

Could you please try this query

index="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Master\ConfigurationCountry.*

[jip31jip31]

hi

now i use this request but Nothing is displayed.
index="" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename key_path="\REGISTRY\USER.\Software\WOW6432Node\Airbus\Master\ConfigurationCountry."
an idea please?

[logloganathan]

Could you please try only this query
ndex="windows" sourcetype=WinRegistry disabled = 0 type=set OR type=create OR type=delete OR type=rename

[logloganathan]

Could you please provide the SS of Index="windows" sourcetype=WinRegistry

or please provide the result sample