As Bob and MHibbin have commented, this is a little vague. Remember, Splunk is first and foremost a data indexing and search engine. By default, it has few ways to generate data. You have to give it some data to process. Once there is data to process, then alerting on it is easy. In my opinion, you have skipped to the "how do I alert on this?" question before you've properly analyzed "how do I get this data into Splunk?".
There are two common approaches for "Port up" and "Port down" data -- one is syslog, the other is an SNMP trap. Most devices that can run an SNMP agent are able to produce linkUp and linkDown traps. With a running snmptrapd , you can feed those traps as events into Splunk. From there, you can alert on them fairly easily. This is documented at http://docs.splunk.com/Documentation/Splunk/4.3.1/Data/SendSNMPeventstoSplunk
Also, this may be use -- http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094aa5.shtml
The syslog approach is pretty simple too, but you have to have devices that you can count on giving you a syslog event from an interface up/down.
Remember that Splunk's architecture is quite different from your average "network monitoring" solution - its focus is on indexing and searching the data, and less on collection / acquisition.
... View more