Using Summary Index for deviation

kunadkat · ‎06-25-2012

How can I accomplish the following:
- Count average number of apache access_common entries span=15m and put it in the summary index(I have to run this everyday)
- Compare realtime data average with 2 weeks ago's summary index data and generate alert if realtime average is 20 percent more summary index data from 14 days ago.

Thanks,

richcollier · ‎10-26-2012

This sounds similar to the question posed here: http://splunk-base.splunk.com/answers/60640/alerting-based-on-deviation-on-multi-dimensional-data

Using Summary Index for deviation

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Using Summary Index for deviation

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas