I am trying to configure Windows registry monitoring via my Splunk Deployment Server but I am don't see anything in the latest Splunk documentation about sysmon.conf.
In the splunkd.log on my Windows client, I am seeing errors related to sysmon.conf such as:
INFO ExecProcessor - message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "D:\Program Files\SplunkUniversalForwarder\bin" -index regmon" splunk-regmon - SysmonMigrator::read - 'sysmon.conf' was not found, no migration is required."
INFO ExecProcessor - message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "D:\Program Files\SplunkUniversalForwarder\bin" -index regmon" splunk-regmon - No enabled entries have been found for regmon or procmon in the conf file.
However, when I go to the Splunk Documentation page, I cannot find any page for sysmon.conf to see how to properly configure it. I see sysmon.conf referenced on this page but a configuration description page does not exist. Is sysmon.conf still in use for Windows Registry Monitoring?
