Alerting

create EXTRACTION

sphiwee
Contributor

Good day, I would like to create an alert for the below error, can i get a regex for the higlighted part  and how would i go about creating the alert, or should I just look out for the event and set to trigger whenever its > 0.


2020-11-14 23:04:24 [http-nio-127.0.0.1-7080-exec-7] LdapHealthChecker [ERROR] Error loading the user groups from LDAP server. Please check the ldap.server.url, ldap.bind.dn, ldap.bind.password secure connection properties. Refer to "Manage Configuration Properties Guide". org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sphiwee,

at first, if you have to search the string "LDAP:errorcode49" you don't need a regex but a simple text search.

Then you have to manage the threeshold and you can do this in two ways:

  • in the same search,
  • in the number of occurrencies.

In the first case, you can run a search like this:

your_search "LDAP: error code 49"
| stats count
| where count>0

where 0 is the threeshold that obviously will has the value you need.

Otherwise, you can run only the search (without stats and where) and manage the threeshold in the number occurrencies in the alert definition.

I usually prefer the first solution, but they are the same thing.

Ciao.

Giuseppe

sphiwee
Contributor

I want to have a message on the alert such as "Error code alert on host: ........"

The way you're doing it is this achievable? and how?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sphiwee,

you have to modify the search adding the host information:

your_search "LDAP: error code 49"
| stats count BY host
| where count>0

then add the info following the instructions at https://docs.splunk.com/Documentation/Splunk/8.1.0/Alert/EmailNotificationTokens

"Error code alert on host: ........$result.fieldname$"

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...