Hello All - Is it possible to create a search or alert that is based on dynamic variables? The end goal I'm trying to achieve is to send an email if any of the tests exceed a 10% increase in run time.  I have the following search query which generates a table I want, however I want this to run every night on between versionN and versionN-1.       index="fe" source="regress_rpt" pipeline="soc" version IN("23ww10b","23ww11a") dut="*" (testlist="*") (testName="*") status="*" earliest=-1mon latest=now() | eval lastTestPathElement=replace(testPath, ".*/" ,"") |search lastTestPathElement="**" | chart max(cyclesPerCpuSec) AS max:cyclesPerCpuSec BY version lastTestPathElement | transpose header_field=version column_name=test_run | eval cycles_version_delta=('23ww11a' - '23ww10b') ,diff_percentage=round('cycles_version_delta'/'23ww11a' * 100, 1) ,status=if(diff_percentage < 10, "PASS", "FAIL")     Results Table test_run 23ww10b 23ww11a cycles_version_delta diff_percentage status basic_test 631.68 663.80 32.12 4.80 PASS basic_test.1 457.48 742.98 285.50 38.40 FAIL basic_test.2 730.04 691.25 -.38.79 -5.60 PASS   This search is hard-coded to the version 23ww10b and 23ww11a.  I'd like to be able to automatically run this search on the latest version and latest version - 1 as well as send an email if there is any FAIL in the status column.   What is the best way to do this, if even possible.   Thanks,   Phil ... View more

Hello All - I'm fairly new to Splunk and I've been racking my head for the past 8 hours trying to create a table for comparing two sets of runs. My search string is as follows: index="fe" source="regress_rpt" pipeline="soc" version IN ("(version="23ww09a" OR version="23ww10b")") dut="*" cthModel="*" (testlist="*") (testName="*") status=* | rex field=testPath "/regression/(?<regressionPath>.*)" | search regressionPath="*" | search regressionPath="***"| stats values(cyclesPerCpuSec) values(version) by testPath | reverse This will generate a table similar to:     testPath values(cyclesPerCpuSec) vales(version) test.6 719.91 23ww10b test.5 742.44 23ww10b test.4 563.46 23ww10b test.6 694.36 23ww10a test.5 423.23 23ww10a test.4 146.34 23ww10a   However, I want to display a table that looks like   testPath 23ww10a 23ww10b test.6 694.36 719.91 test.5 423.23 742.44 test.4 146.34 563.46   Essentially, I'm trying to create table so I can compare the results of a specific test across different model versions. Any help is greatly appreciated! Thanks, Phil ... View more

Hello All - I need to be able to compare/graph regression test results from two different models.  The search command to create a table for one of the searches is: index="frontEnd" source="regress_rpt" pipeline="my_pipe" version="23ww10b" dut="*"  (testlist="*") (testName="*") status="*" | table cyclesPerCpuSec wall_hz testPath rpt This returns a table with 6 rows (As there are 6 tests per version). Is there a way to compare the cyclesPerCpuSec of this search to a new search which has a different version? I.e. index="frontEnd" source="regress_rpt" pipeline="my_pipe" version="23ww10a" dut="*"  (testlist="*") (testName="*") status="*" | table cyclesPerCpuSec wall_hz testPath rpt Thanks, Pip   ... View more