https://community.splunk.com/t5/Knowledge-Management/Using-Summary-Index-for-deviation/m-p/82862#M845 <P>How can I accomplish the following:<BR /> - Count average number of apache access_common entries span=15m and put it in the summary index(I have to run this everyday)<BR /> - Compare realtime data average with 2 weeks ago's summary index data and generate alert if realtime average is 20 percent more summary index data from 14 days ago.</P> <P>Thanks,</P> Mon, 25 Jun 2012 15:24:52 GMT kunadkat 2012-06-25T15:24:52Z https://community.splunk.com/t5/Knowledge-Management/Using-Summary-Index-for-deviation/m-p/82862#M845 <P>How can I accomplish the following:<BR /> - Count average number of apache access_common entries span=15m and put it in the summary index(I have to run this everyday)<BR /> - Compare realtime data average with 2 weeks ago's summary index data and generate alert if realtime average is 20 percent more summary index data from 14 days ago.</P> <P>Thanks,</P> Mon, 25 Jun 2012 15:24:52 GMT https://community.splunk.com/t5/Knowledge-Management/Using-Summary-Index-for-deviation/m-p/82862#M845 kunadkat 2012-06-25T15:24:52Z https://community.splunk.com/t5/Knowledge-Management/Using-Summary-Index-for-deviation/m-p/82863#M846 <P>This sounds similar to the question posed here: <A href="http://splunk-base.splunk.com/answers/60640/alerting-based-on-deviation-on-multi-dimensional-data">http://splunk-base.splunk.com/answers/60640/alerting-based-on-deviation-on-multi-dimensional-data</A></P> Fri, 26 Oct 2012 20:18:40 GMT https://community.splunk.com/t5/Knowledge-Management/Using-Summary-Index-for-deviation/m-p/82863#M846 richcollier 2012-10-26T20:18:40Z