Documentation: 3.3.2
|  Print Version Contents
This page last updated: 06/30/08 05:06pm

Configure inputs for Windows

You can configure the Windows version of Splunk to index your Windows Application, System, and Security event logs, as well as monitor and index changes to your registry and set up WMI data input. This functionality is not yet exposed in Splunk Web or the CLI.

When you run the Splunk Windows installer, you are given the option to set up indexing and/or monitoring for the event logs, the registry, and for WMI. If you choose to do this, the default values for these settings are assumed. Once you have completed the installation, you can then make changes to the default values set by the installation process. Depending on

If you want to make changes to the default values, edit a copy of inputs.conf in $SPLUNK_HOME\etc\system\local\. You only have to provide values for the parameters you want to change within the stanza. For more information about how to work with Splunk configuration files, refer to How do configuration files work?

Configure indexing for Windows event logs

The settings for which event logs to index are in the following stanza in inputs.conf:

# Windows platform specific input processor.
[WinEventLog:Application] 
[WinEventLog:Security]
[WinEventLog:System]

To disable indexing for an event log, use # to comment it out in this stanza in $SPLUNK_HOME\etc\system\local\inputs.conf.

Configure Windows registry monitoring input

The global settings for Windows registry monitoring are in the following stanza in inputs.conf:

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.py]
interval = 60
sourcetype = WinRegistry
source = WinRegistry
disabled = 0

Note: The Splunk registry input monitoring script (splunk-regmon.py) is configured as a scripted input. Do not change this value.

  • source: labels these events as coming from the registry.
  • sourcetype: assigns these events as registry events.
  • interval: specifies how frequently to poll the registry for changes, in seconds.
  • disabled: indicates whether the feature is enabled. Set this to 1 to disable this feature.

The Windows registry monitoring functionality uses two additional configuration files that are described in Windows registry input. You may wish to review this information before proceeding.

Note: You must use two backslashes \\ to escape wildcards in stanza names in inputs.conf. Regexes with backslashes in them are not currently supported when specifying paths to files.

Previous: Configure inputs via inputs.conf    |    Next: WMI input

Comments

  1. I you to have admin@zambito.org can I have that?
    Posted by adminzambitoorg on Jul 04 2008, 3:00pm

Log in to comment.