https://community.splunk.com/t5/Monitoring-Splunk/Monitor-When-Trunk-Ports-Go-Down/m-p/220922#M7963 <P>Watch firewall logs while you either shut down or disconnect a switchport. See what sort of event it logs for this. </P> <P>Or try a search in Splunk for "down" or "shut" or something. The point is, you have to define what an event involving a port being shut down "looks like". (I'd help you more with this, but I don't have Cisco equipment at home to test with).</P> <P>Once you find the events and can create a search that only has those events, then click "Save As" in the upper right and select Alert, then fill in the settings. You can watch this free <A href="http://www.splunk.com/view/SP-CAAAGYG">Splunk training video on creating alerts</A> (only 4 and a half minutes long) for more help.</P> <P>If you need more help, we'll probably need a sample of the events that show it's down. But hopefully this was enough to get you what you needed!</P> Sat, 23 Apr 2016 03:15:50 GMT Richfez 2016-04-23T03:15:50Z https://community.splunk.com/t5/Monitoring-Splunk/Monitor-When-Trunk-Ports-Go-Down/m-p/220921#M7962 <P>Hello,<BR /> I am looking to set up an alert for when a trunk port on a Cisco switch goes down. </P> Fri, 22 Apr 2016 20:40:47 GMT https://community.splunk.com/t5/Monitoring-Splunk/Monitor-When-Trunk-Ports-Go-Down/m-p/220921#M7962 lgn1br 2016-04-22T20:40:47Z https://community.splunk.com/t5/Monitoring-Splunk/Monitor-When-Trunk-Ports-Go-Down/m-p/220922#M7963 <P>Watch firewall logs while you either shut down or disconnect a switchport. See what sort of event it logs for this. </P> <P>Or try a search in Splunk for "down" or "shut" or something. The point is, you have to define what an event involving a port being shut down "looks like". (I'd help you more with this, but I don't have Cisco equipment at home to test with).</P> <P>Once you find the events and can create a search that only has those events, then click "Save As" in the upper right and select Alert, then fill in the settings. You can watch this free <A href="http://www.splunk.com/view/SP-CAAAGYG">Splunk training video on creating alerts</A> (only 4 and a half minutes long) for more help.</P> <P>If you need more help, we'll probably need a sample of the events that show it's down. But hopefully this was enough to get you what you needed!</P> Sat, 23 Apr 2016 03:15:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/Monitor-When-Trunk-Ports-Go-Down/m-p/220922#M7963 Richfez 2016-04-23T03:15:50Z