https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229108#M67850 <P>You may want to have a look at the <A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Aboutalerts">Splunk Alerting documentation</A></P> Tue, 16 Jan 2018 13:06:55 GMT brettcarroll 2018-01-16T13:06:55Z https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229105#M67847 <P>We need to develop an alert when the SiteMinder policy server or ldap connection goes down. </P> <P>Can any one help with the search for this?<BR /> Thanks.</P> Mon, 11 Jan 2016 19:31:27 GMT https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229105#M67847 krishnacasso 2016-01-11T19:31:27Z https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229106#M67848 <P>post some sample logs you have got? and post what do you have tried so far? </P> Wed, 08 Feb 2017 18:35:59 GMT https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229106#M67848 praveenbandi 2017-02-08T18:35:59Z https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229107#M67849 <P>Hi Praveen,</P> <P>Please find the snap of log files below. <BR /> I am trying to configure an alert if host is getting timed out at specific server(server1.abc.com) for continuously 5 Minutes. This alert should be based on time and not on the count. <BR /> I have a field extraction done for {ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389}(Event)---&gt;txt(field)</P> <PRE><CODE>[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:637][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389 [90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:637][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server2.abc.com:389 [90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:67][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server3.abc.com:389 [90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:37][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389 [90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:67][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389[90530/2906] [Wed Jan 09 2017 01:33:36][ConnMgr.cpp:63][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389 [90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:67][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server3.abc.com:389 [90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:63][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389 </CODE></PRE> <P>Here is my search:</P> <PRE><CODE>index=* host="finace.vendor.com" sourcetype="appsm" sm_txt="*ConnMgr (ldap_search_ext_s) in PingServer : Timed out at *:389*" | timechart span=5m dc(txt) </CODE></PRE> <P>This is giving the count of that unique txt. I need to configure a alert if this dc(txt) is logged for continuously for 5 minutes like Alert should not be triggered if it dint get dc(txt) in 4th minute.</P> <P>Thanks.</P> Tue, 29 Sep 2020 12:45:52 GMT https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229107#M67849 krishnacasso 2020-09-29T12:45:52Z https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229108#M67850 <P>You may want to have a look at the <A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Aboutalerts">Splunk Alerting documentation</A></P> Tue, 16 Jan 2018 13:06:55 GMT https://community.splunk.com/t5/Splunk-Search/How-write-a-search-to-alert-when-a-SiteMinder-policy-server-or/m-p/229108#M67850 brettcarroll 2018-01-16T13:06:55Z