Documentation: 3.3
|  Print Version Contents
This page last updated: 09/24/08 01:09pm

Windows inputs

Configure Splunk for Windows to index your Windows Application, System, and Security event logs. Splunk for Windows can also monitor and index changes to your registry and accept WMI data input. This functionality is not yet exposed in Splunk Web or the CLI.

When you run the Splunk Windows installer, you are given the option to set up indexing and/or monitoring for the event logs, the registry, and for WMI. If you choose to do this, the default values for these settings are assumed. Once you have completed the installation, you can then make changes to the default values set by the installation process.

If you want to make changes to the default values, edit a copy of inputs.conf in $SPLUNK_HOME\etc\system\local\. You only have to provide values for the attributes you want to change within the stanza. For more information about how to work with Splunk configuration files, refer to How configuration files work.

Configure indexing for Windows event logs

The settings for which event logs to index are in the following stanza in inputs.conf:

# Windows platform specific input processor.
[WinEventLog:Application] 
[WinEventLog:Security]
[WinEventLog:System]

To disable indexing for an event log, use # to comment it out in this stanza in $SPLUNK_HOME\etc\system\local\inputs.conf.

Configure Windows registry monitoring input

The global settings for Windows registry monitoring are in the following stanza in inputs.conf:

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.py]
interval = 60
sourcetype = WinRegistry
source = WinRegistry
disabled = 0

Note: The Splunk registry input monitoring script (splunk-regmon.py) is configured as a scripted input. Do not change this value.

  • source: labels these events as coming from the registry.
  • sourcetype: assigns these events as registry events.
  • interval: specifies how frequently to poll the registry for changes, in seconds.
  • disabled: indicates whether the feature is enabled. Set this to 1 to disable this feature.

The Windows registry monitoring functionality uses two additional configuration files that are described in Windows registry input. You may wish to review that page before proceeding.

Note: You must use two backslashes \\ to escape wildcards in stanza names in inputs.conf. Regexes with backslashes in them are not currently supported when specifying paths to files.

Previous: Crawl    |    Next: Windows Management Interface (WMI) input

Comments

  1. I you to have admin@zambito.org can I have that?
    Posted by adminzambitoorg on Jul 04 2008, 3:00pm

Log in to comment.