We had quite a frustrating time figuring this out, so here is your answer. More then likely the events your seeing are due to windows registry monitor process running on your windows servers. (verify by looking at task manager for a process named splunk-regmon.exe) Once you see that process your half way home.. Modify your inputs.conf file and the stanza that looks like [WinRegMon://default] disabled = 0 hive = .* proc = .* type = rename|set|delete|create index = windows To... [WinRegMon://default] disabled = 0 hive = .* proc = ^((?!(reg.exe|svchost.exe)).)*$ type = rename|set|delete|create index = windows Reload, run your deployment or the things you typically do.. Then sit back and tell your boss you just saved them many hundreds or thousands of dollars.. Happy Splunking!! ... View more