How write a search to alert when a SiteMinder policy server or LDAP connection goes down?

[krishnacasso]

We need to develop an alert when the SiteMinder policy server or ldap connection goes down.

Can any one help with the search for this?
Thanks.

[brettcarroll]

You may want to have a look at the Splunk Alerting documentation

[krishnacasso]

Hi Praveen,

Please find the snap of log files below.
I am trying to configure an alert if host is getting timed out at specific server(server1.abc.com) for continuously 5 Minutes. This alert should be based on time and not on the count.
I have a field extraction done for {ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389}(Event)--->txt(field)

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:637][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:637][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server2.abc.com:389

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:67][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server3.abc.com:389

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:37][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:67][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389[90530/2906]

[Wed Jan 09 2017 01:33:36][ConnMgr.cpp:63][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:67][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server3.abc.com:389

[90530/2906][Wed Jan 09 2017 01:33:36][ConnMgr.cpp:63][ERROR][sm-Ldap-080] ConnMgr (ldap_search_ext_s) in PingServer : Timed out at Server1.abc.com:389

Here is my search:

index=* host="finace.vendor.com" sourcetype="appsm" sm_txt="*ConnMgr (ldap_search_ext_s) in PingServer : Timed out at *:389*" | timechart span=5m dc(txt) 

This is giving the count of that unique txt. I need to configure a alert if this dc(txt) is logged for continuously for 5 minutes like Alert should not be triggered if it dint get dc(txt) in 4th minute.

Thanks.

[praveenbandi]

post some sample logs you have got? and post what do you have tried so far?