Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Is there a way for a universal forwarder to monito...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to determine if there is a way for the Splunk Universal Forwarder to monitor environmental variables. We have an in-house application that uses a particular one to determine whether a service should be actively running certain processes (i.e. the service should only run the process if it is flagged as the active server). Is there a way for the Universal Forwarder to monitor these values?
Ideally what I am shooting for is to send an alert when it changes from active to standby (or vice versa).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could create a Scripted Input that runs whatever command that dumps the environment variable. Then you would have regular periodic updates as to the current value. Alternatively, you could create a script that monitors the variable and whenever it changes it writes a line to a log that says something like "ENV changed from X to Y" and then monitor that log file. You could even do the same thing but instead of writing to a log, you could send SNMP Trap to Splunk when the variable changes, if that more fits your model of how you do things.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could create a Scripted Input that runs whatever command that dumps the environment variable. Then you would have regular periodic updates as to the current value. Alternatively, you could create a script that monitors the variable and whenever it changes it writes a line to a log that says something like "ENV changed from X to Y" and then monitor that log file. You could even do the same thing but instead of writing to a log, you could send SNMP Trap to Splunk when the variable changes, if that more fits your model of how you do things.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is what I thought might be a solution, but wasn't sure if there was anything built in natively with Universal Forwarder.
Thanks! I will see if anyone else has any good ideas before marking accepted.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
