If you plan to monitor more than one hive, each hive requires its own separate input. Splunk Windows Registry monitoring uses a configuration file to determine what to monitor on your system, inputs.conf. This file must reside in %SPLUNK_HOME%\etc\system\local\ on the machine that runs Registry monitoring. You can capture a baseline snapshot of the current …