Force collections to run on agent startup

[richprescott]

Is there any way to force a collection to run if it has not been run before?

As an example, I want to collect BIOS information using WMI.conf and have the interval set to 30 days. When I restarted the agent, it did not collect the information immediately and I apparently have to wait up to 30 days for the first collection to run.

This would hopefully be something that would run at agent startup as long as it has not been collected in the specified interval.

[richprescott · Accepted solution]

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.