how would I do this process in Windows Server 2019 running Splunk? ... View more

Anyone? Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR.  I want to monitor when the Start value changes from a 3 or 4 and what machine, user, etc that made the change.  I am working on the Splunk_TA_Windows and go to the inputs.conf file and put in the input but I am not sure if that is the correct place or why it doesn’t report the change in search in Splunk.  It does create an event code in Windows for the change so I think it is a matter of getting the input worded correctly or something. ... View more