I am trying to determine if there is a way for the Splunk Universal Forwarder to monitor environmental variables. We have an in-house application that uses a particular one to determine whether a service should be actively running certain processes (i.e. the service should only run the process if it is flagged as the active server). Is there a way for the Universal Forwarder to monitor these values?
Ideally what I am shooting for is to send an alert when it changes from active to standby (or vice versa).
You could create a Scripted Input that runs whatever command that dumps the environment variable. Then you would have regular periodic updates as to the current value. Alternatively, you could create a script that monitors the variable and whenever it changes it writes a line to a log that says something like "ENV changed from X to Y" and then monitor that log file. You could even do the same thing but instead of writing to a log, you could send SNMP Trap to Splunk when the variable changes, if that more fits your model of how you do things.