Getting Data In

Force collections to run on agent startup

richprescott
Path Finder

Is there any way to force a collection to run if it has not been run before?

As an example, I want to collect BIOS information using WMI.conf and have the interval set to 30 days. When I restarted the agent, it did not collect the information immediately and I apparently have to wait up to 30 days for the first collection to run.

This would hopefully be something that would run at agent startup as long as it has not been collected in the specified interval.

0 Karma
1 Solution

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

View solution in original post

0 Karma

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...