Getting Data In

Force collections to run on agent startup

richprescott
Path Finder

Is there any way to force a collection to run if it has not been run before?

As an example, I want to collect BIOS information using WMI.conf and have the interval set to 30 days. When I restarted the agent, it did not collect the information immediately and I apparently have to wait up to 30 days for the first collection to run.

This would hopefully be something that would run at agent startup as long as it has not been collected in the specified interval.

0 Karma
1 Solution

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

View solution in original post

0 Karma

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...