Splunk Search

What is splunkdrv?

Lowell
Super Champion

Can anyone explain the purpose and function of the "splunkdrv" Windows service? It appears as though this is some kind of kernel-mode driver. I'm curious what Splunk needs to do in kernel-mode that couldn't be done at user-level.

Tags (1)
0 Karma
1 Solution

rovechkin_splun
Splunk Employee
Splunk Employee

splunkdrv is kernel mode filter driver for Windows registry. Essentially it allows Splunk to listen to every call to registry and log it as a registry event. Windows implements its driver framework such that it allows such lightweight filter drivers to be plugged into existing drivers such as registry file system, etc.

View solution in original post

rovechkin_splun
Splunk Employee
Splunk Employee

splunkdrv is kernel mode filter driver for Windows registry. Essentially it allows Splunk to listen to every call to registry and log it as a registry event. Windows implements its driver framework such that it allows such lightweight filter drivers to be plugged into existing drivers such as registry file system, etc.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...