Getting Data In

Force collections to run on agent startup

richprescott
Path Finder

Is there any way to force a collection to run if it has not been run before?

As an example, I want to collect BIOS information using WMI.conf and have the interval set to 30 days. When I restarted the agent, it did not collect the information immediately and I apparently have to wait up to 30 days for the first collection to run.

This would hopefully be something that would run at agent startup as long as it has not been collected in the specified interval.

0 Karma
1 Solution

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

View solution in original post

0 Karma

richprescott
Path Finder

Found the issue! At some point during editing of the file, SYSTEM was removed from the ACL. Re-added SYSTEM with full permissions, restarted the agent and the data was recorded.

On a side note, no errors were shown in splunkd.log, because Splunk couldn't even see the file to know that it didn't have permissions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...