Hi krishnacasso,
Welcome to Splunk 🙂
if you already have a field called status which represents the status code, you can run a search like this:
your base search to get the apache logs earliest=-11min@min | bin _time span=1min | stats count(eval(status=="500")) by time | where count>=10
This will count status="500" per minute and if the count is bigger or equal 10 show the result. You can safe this as an alert http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Aboutalerts
If the status field is not yet available run the above search with some regex to get the field :
your base search to get the apache logs earliest=-11min@min | rex ""\s(?<status>\d+)\s\d" | bin _time span=1min | stats count(eval(status=="500")) by time | where count>=10
Hope this helps to get you started ...
cheers, MuS
PS: This is un-tested, because I don't have a Splunk handy right now 😉
