Windows Registry monitoring works for local host not on universal forwarder

[VasukiPramod]

Hi Team,
The following inputs.conf works on localhost to monitor a registry key, but not working on the universal forwarder.

[WinRegMon://HKLM]
baseline=1
disabled=0
hive=\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.*
index=windows
proc=.*
type=set|create|delete|rename

BTW even the following hive attribute too works fine on local host but not on universal forwarder

hive=HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.*

But the default configuraiton of inputs.conf works on both local host and the universal forwarder.

[WinRegMon://default]
disabled = 0
hive = .*
proc = .*
type = rename|set|delete|create
index = windows

Any references are much helpful.