https://community.splunk.com/t5/Getting-Data-In/Force-collections-to-run-on-agent-startup/m-p/68757#M13919 <P>Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.</P> <P>On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.</P> Thu, 07 Jun 2012 21:53:39 GMT richprescott 2012-06-07T21:53:39Z https://community.splunk.com/t5/Getting-Data-In/Force-collections-to-run-on-agent-startup/m-p/68756#M13918 <P>Is there any way to force a collection to run if it has not been run before?</P> <P>As an example, I want to collect BIOS information using WMI.conf and have the interval set to 30 days. When I restarted the agent, it did not collect the information immediately and I apparently have to wait up to 30 days for the first collection to run.</P> <P>This would hopefully be something that would run at agent startup as long as it has not been collected in the specified interval.</P> Wed, 06 Jun 2012 17:43:43 GMT https://community.splunk.com/t5/Getting-Data-In/Force-collections-to-run-on-agent-startup/m-p/68756#M13918 richprescott 2012-06-06T17:43:43Z https://community.splunk.com/t5/Getting-Data-In/Force-collections-to-run-on-agent-startup/m-p/68757#M13919 <P>Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.</P> <P>On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.</P> Thu, 07 Jun 2012 21:53:39 GMT https://community.splunk.com/t5/Getting-Data-In/Force-collections-to-run-on-agent-startup/m-p/68757#M13919 richprescott 2012-06-07T21:53:39Z