https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248281#M74091 <P>DaniR86, did either of the below help you get to your answer?</P> <P>If so, could you please mark one as answered? </P> <P>If not, give us a bit more detail about how far you've gotten and maybe we can help you with the rest! </P> Sun, 17 Jul 2016 12:48:34 GMT Richfez 2016-07-17T12:48:34Z https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248278#M74088 <P>I am trying to add a new field to my data that lists the second lowest number in a data set. </P> <P>So if I have</P> <P>New York 100<BR /> New York 300<BR /> New York 150<BR /> Florida 20<BR /> Florida 23<BR /> Florida 17<BR /> Las Vegas 70<BR /> Las Vegas 78<BR /> Las Vegas 55</P> <P>I would like to see...</P> <P>New York 150<BR /> Florida 20<BR /> Las Vegas 70 </P> <P>The search I have has quite a lot in it already so building a new field with an eval statement near the start will probably be my best option.</P> <P>Thanks in advance for any help x</P> Mon, 11 Jul 2016 10:22:18 GMT https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248278#M74088 DaniR86 2016-07-11T10:22:18Z https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248279#M74089 <P>Add to your existing search...</P> <PRE><CODE>... | top limit=2 MyField | rare limit=1 MyField </CODE></PRE> <P>Obviously, put your field name in for <CODE>MyField</CODE>.</P> Mon, 11 Jul 2016 11:32:03 GMT https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248279#M74089 Richfez 2016-07-11T11:32:03Z https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248280#M74090 <P>Try this (assuming two fields shown in your example are city and count)<BR /> <STRONG>Added missing pipe</STRONG> </P> <PRE><CODE>... | sort count | streamstats count as c by city | where c=2 | fields - c </CODE></PRE> Mon, 11 Jul 2016 12:09:31 GMT https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248280#M74090 sundareshr 2016-07-11T12:09:31Z https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248281#M74091 <P>DaniR86, did either of the below help you get to your answer?</P> <P>If so, could you please mark one as answered? </P> <P>If not, give us a bit more detail about how far you've gotten and maybe we can help you with the rest! </P> Sun, 17 Jul 2016 12:48:34 GMT https://community.splunk.com/t5/Splunk-Search/Find-the-second-lowest/m-p/248281#M74091 Richfez 2016-07-17T12:48:34Z