topic create EXTRACTION in Alerting

create EXTRACTION

sphiwee — Tue, 01 Dec 2020 06:18:43 GMT

Good day, I would like to create an alert for the below error, can i get a regex for the higlighted part and how would i go about creating the alert, or should I just look out for the event and set to trigger whenever its > 0.

2020-11-14 23:04:24 [http-nio-127.0.0.1-7080-exec-7] LdapHealthChecker [ERROR] Error loading the user groups from LDAP server. Please check the ldap.server.url, ldap.bind.dn, ldap.bind.password secure connection properties. Refer to "Manage Configuration Properties Guide". org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]

Re: create EXTRACTION

gcusello — Tue, 01 Dec 2020 07:10:29 GMT

Hi @sphiwee,

at first, if you have to search the string "LDAP:errorcode49" you don't need a regex but a simple text search.

Then you have to manage the threeshold and you can do this in two ways:

in the same search,
in the number of occurrencies.

In the first case, you can run a search like this:

your_search "LDAP: error code 49" | stats count | where count>0

where 0 is the threeshold that obviously will has the value you need.

Otherwise, you can run only the search (without stats and where) and manage the threeshold in the number occurrencies in the alert definition.

I usually prefer the first solution, but they are the same thing.

Ciao.

Giuseppe

Re: create EXTRACTION

sphiwee — Tue, 01 Dec 2020 08:15:38 GMT

I want to have a message on the alert such as "Error code alert on host: ........"

The way you're doing it is this achievable? and how?

Re: create EXTRACTION

gcusello — Tue, 01 Dec 2020 11:12:38 GMT

Hi @sphiwee,

you have to modify the search adding the host information:

your_search "LDAP: error code 49" | stats count BY host | where count>0

then add the info following the instructions at https://docs.splunk.com/Documentation/Splunk/8.1.0/Alert/EmailNotificationTokens

"Error code alert on host: ........$result.fieldname$"

Ciao.

Giuseppe