Watch firewall logs while you either shut down or disconnect a switchport. See what sort of event it logs for this.
Or try a search in Splunk for "down" or "shut" or something. The point is, you have to define what an event involving a port being shut down "looks like". (I'd help you more with this, but I don't have Cisco equipment at home to test with).
Once you find the events and can create a search that only has those events, then click "Save As" in the upper right and select Alert, then fill in the settings. You can watch this free Splunk training video on creating alerts (only 4 and a half minutes long) for more help.
If you need more help, we'll probably need a sample of the events that show it's down. But hopefully this was enough to get you what you needed!
