create EXTRACTION

[sphiwee]

Good day, I would like to create an alert for the below error, can i get a regex for the higlighted part  and how would i go about creating the alert, or should I just look out for the event and set to trigger whenever its > 0.


2020-11-14 23:04:24 [http-nio-127.0.0.1-7080-exec-7] LdapHealthChecker [ERROR] Error loading the user groups from LDAP server. Please check the ldap.server.url, ldap.bind.dn, ldap.bind.password secure connection properties. Refer to "Manage Configuration Properties Guide". org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]

[gcusello]

Hi @sphiwee,

at first, if you have to search the string "LDAP:errorcode49" you don't need a regex but a simple text search.

Then you have to manage the threeshold and you can do this in two ways:

• in the same search,
• in the number of occurrencies.

In the first case, you can run a search like this:

your_search "LDAP: error code 49"
| stats count
| where count>0

where 0 is the threeshold that obviously will has the value you need.

Otherwise, you can run only the search (without stats and where) and manage the threeshold in the number occurrencies in the alert definition.

I usually prefer the first solution, but they are the same thing.

Ciao.

Giuseppe

[sphiwee]

I want to have a message on the alert such as "Error code alert on host: ........"

The way you're doing it is this achievable? and how?

[gcusello]

Hi @sphiwee,

you have to modify the search adding the host information:

your_search "LDAP: error code 49"
| stats count BY host
| where count>0

then add the info following the instructions at https://docs.splunk.com/Documentation/Splunk/8.1.0/Alert/EmailNotificationTokens

"Error code alert on host: ........$result.fieldname$"

Ciao.

Giuseppe