Documentation > Splunk > Admin Manual > regmon-filters.conf

Admin Manual

 


Welcome to Splunk administration
What to do first
Use Splunk Web
Meet Splunk apps
Configure Splunk
Indexing with Splunk
Add data and configure inputs
Set up forwarding and receiving
Configure event processing
Configure event timestamping
Configure indexed field extraction
Manage users
Manage indexes
Define alerts
Set up backups and retention policies
Configure data security
Deploy to other Splunk instances
Set up distributed search
Manage search jobs
Use Splunk's command line interface (CLI)
Configuration file reference
Troubleshooting

regmon-filters.conf

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

regmon-filters.conf

The following are the spec and example files for regmon-filters.conf.

regmon-filters.conf.spec

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.1.5 
#
# This file contains potential attribute/value pairs to use when configuring Windows registry
# monitoring. The regmon-filters.conf file is used in conjunction with sysmon.conf, and 
# contains the specific regular expressions you create to refine and filter the hive key paths 
# you want Splunk to monitor. You must restart Splunk to enable configurations. 
# 
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles

[<stanza name>
	* Name of the filter being defined.

proc = <string>
	* Regex specifying process image that you want Splunk to monitor.

hive = <string>
	* Regex specifying the registry key path that you want Splunk to monitor.

type = <string>
	* Regex specifying the type(s) of registry event that you want Splunk to monitor. 
        This must be a subset of those defined for the event_types attribute in regmon-filters.conf.

baseline = <int 0|1>
	* Whether or not to establish a baseline value for the keys this filter defines. 

baseline_interval = <int>
	* The threshold, in seconds, for how long Spunk has to have been down before re-taking the 
          snapshot. 

disabled = <int 0|1>
	* Disables or enables a given filter.

regmon-filters.conf.example

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.1.5 
#
# This file contains example registry monitor filters 
#
# To use one or more of these configurations, copy the configuration block into
# regmon-filters.conf in $SPLUNK_HOME/etc/search/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles


# The following are examples of registry monitor filters.  To create your own filter, modify 
# the values by following the spec outlined in regmon-filters.conf.spec.

[default]
disabled = 1
baseline = 0
baseline_interval = 86400

[User keys]
proc = \\Device\\.*
hive = \\REGISTRY\\USER\\.*
type = set|create|delete|rename
Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1/Admin/Regmon-filtersconf"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!