|
I'm running version 4.0.8 splunk on Windows 2000 and it continually generates the following error. Application popup: splunk-regmon.exe - Entry Point Not Found : The procedure entry point GetProcessImageFileNameW could no be located in the dynamic link library PSAPI.DLL. Event ID: 26 Source: Application Popup |
|
1) Windows 2000 is not a supported platform. Splunk will run mostly just fine on it, but there's no guarantee everything will work 100%. Microsoft have already withdrawn genearl support for this OS 2) The 'regmon' script in the Windows app is causing the error. If you disable the regmon input in $SPLUNK_HOME/etc/apps/windows/default/inputs.conf, it will cease to bother you. |
|
We had this same problem in a test we were running in a customer environment. This post was a lot of help. However, we disabled the input in the .conf file in the directory above with no result. We found that this input is enabled by default, so we had to edit the inputs.conf under $SPLUNK_HOME/etc/system/default and change the regmon stanza to disabled=1. @gpgburgett: Did you disable the input in the ../local/inputs.conf file or simply remove it?
(20 Jan '11, 00:38)
mctester
We just disabled the input in the conf file. You're right, it should layer the conf files and apply them according to splunk's precedence rules. We've had this problem before though, especially on Windows, where Splunk doesn't recognize conf file changes right away, even after restart. If we had waited or tried restarting a few more times it probably would have worked. But in that case when we changed the default file, the change was applied right away.
(20 Jan '11, 18:20)
gpburgett
|
