Splunk Search

Help with creating table

Pip9ball
Explorer

Hello All -

I'm fairly new to Splunk and I've been racking my head for the past 8 hours trying to create a table for comparing two sets of runs.

My search string is as follows:

index="fe" source="regress_rpt" pipeline="soc" version IN ("(version="23ww09a" OR version="23ww10b")") dut="*" cthModel="*" (testlist="*") (testName="*") status=* | rex field=testPath "/regression/(?<regressionPath>.*)" | search regressionPath="*" | search regressionPath="***"| stats values(cyclesPerCpuSec) values(version) by testPath | reverse

This will generate a table similar to:

 

 

testPathvalues(cyclesPerCpuSec)vales(version)
test.6719.9123ww10b
test.5742.4423ww10b
test.4563.4623ww10b
test.6694.3623ww10a
test.5423.2323ww10a
test.4146.3423ww10a

 

However, I want to display a table that looks like

 

testPath23ww10a23ww10b
test.6694.36719.91
test.5423.23742.44
test.4146.34563.46

 

Essentially, I'm trying to create table so I can compare the results of a specific test across different model versions.

Any help is greatly appreciated!

Thanks,

Phil

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use chart rather than stats

| chart values(cyclesPerCpuSec) over testPath by version

That puts version across the columns and testPath down the side.

 

Note: When posting SPL snippets, use a code block </> to create a box like above 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use chart rather than stats

| chart values(cyclesPerCpuSec) over testPath by version

That puts version across the columns and testPath down the side.

 

Note: When posting SPL snippets, use a code block </> to create a box like above 

0 Karma

Pip9ball
Explorer

@bowesmana - Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...