Is there a way for a universal forwarder to monitor Environment Variables?

[duffeysplunk]

I am trying to determine if there is a way for the Splunk Universal Forwarder to monitor environmental variables. We have an in-house application that uses a particular one to determine whether a service should be actively running certain processes (i.e. the service should only run the process if it is flagged as the active server). Is there a way for the Universal Forwarder to monitor these values?

Ideally what I am shooting for is to send an alert when it changes from active to standby (or vice versa).

[woodcock · Accepted solution]

You could create a Scripted Input that runs whatever command that dumps the environment variable. Then you would have regular periodic updates as to the current value. Alternatively, you could create a script that monitors the variable and whenever it changes it writes a line to a log that says something like "ENV changed from X to Y" and then monitor that log file. You could even do the same thing but instead of writing to a log, you could send SNMP Trap to Splunk when the variable changes, if that more fits your model of how you do things.

[duffeysplunk]

That is what I thought might be a solution, but wasn't sure if there was anything built in natively with Universal Forwarder.

Thanks! I will see if anyone else has any good ideas before marking accepted.