I'm not wanting to monitor these events and yet the scripts still run every minute (by looking at the task manager). I have tried adding stanzas to disable them in etc/system/local/inputs.conf but this doesn't seem to work, the still run.
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 1
[script://$SPLUNK_HOME\bin\scripts\splunk-netmon.path]
disabled = 1
[script://$SPLUNK_HOME\bin\scripts\splunk-winprintmon.path]
disabled = 1
[script://$SPLUNK_HOME\bin\scripts\splunk-powershell.path]
disabled = 1
[script://$SPLUNK_HOME\bin\scripts\splunk-powershell2.path]
disabled = 1
[WinRegMon]
disabled=1
[WinNetMon]
disabled=1
[WinPrintMon]
disabled=1
[perfmon]
disabled=1
[admon]
disabled=1
[powershell]
disabled=1
[powershell2]
disabled=1
I can see in the splunk.log file the following
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe"
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe"
INFO ExecProcessor - interval: run once
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"
INFO ExecProcessor - interval: 60000 ms
INFO ExecProcessor - New scheduled exec process: "C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"
INFO ExecProcessor - interval: 60000 ms
↧