How to monitor servers using splunk

[2powder]

I have been tasked with figuring out how to monitor server activity using splunk and create alerts

[2powder]

For example, let's say that we have 10 servers that all run the same code. The traffic is load balanced and the code performs a process, that either completes successfully. At the end of the process there is a flag that is set such as "Successful = yes or no". There is also a couple of identifiers such as the vendor ie. "ABC Company" and then there is a unique "Process ID". This process is called real time 24/7. What I am looking for is an alert that will alert me (and others) when a certain threshold has been exceeded. For example, for ABC Company if the Successful = no count < 5 during a certain time period then no alert, but as soon as it goes over 5, then I am alerted.

I hope that this helped.

Thank you

[ddrillic]

First step is to collect the relevant data from the logs (I assume). The moment you have the data, you can work on the alerts.

[2powder]

That information is already being collected

[davebrooking]

maybe this video about creating alerts will help https://www.youtube.com/watch?annotation_id=annotation_2942967387&feature=iv&src_vid=SuARLqm7_jc&v=0...

Dave

[somesoni2]

Could you provide more details on what you mean by "server activity"?