Getting Data In

Force collections to run on agent startup

richprescott
Path Finder

Is there any way to force a collection to run if it has not been run before?

As an example, I want to collect BIOS information using WMI.conf and have the interval set to 30 days. When I restarted the agent, it did not collect the information immediately and I apparently have to wait up to 30 days for the first collection to run.

This would hopefully be something that would run at agent startup as long as it has not been collected in the specified interval.

0 Karma
1 Solution

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

View solution in original post

0 Karma

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...