The following set up was used in regmon-filters.conf:
proc = C:\\.*
baseline = 0
disabled = 0
hive = HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR\\?.*
index = default
type = rename|close|set|delete|open|create|query
When adding a USB drive, I see nothing being reported on. What is going on?
This is a known issue - SPL-58682 - with Splunk monitoring the Current Control Set for this section. The work around is to use the following setting for hive:
hive = HKEY_LOCAL_MACHINE\\SYSTEM\\*CONTROLSET*\\ENUM\\USBSTOR?.*
This will monitor all control sets for changes for that path.
View solution in original post