Splunk Search

how to find third largest salary from a salary field

Tamilraj28
Engager

Please help me in Finding the 3rd or nth largest value from a field...

SALARY

10000
30000
20000
80000
60000
93000
55000

we need to get 3rd largest as 60000

Please give the spl and help me

Tags (1)
0 Karma

Vijeta
Influencer

Try this-

<your search>| sort -SALARY | streamstats count as rank  by SALARY| where rank=3
0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults
| eval SALARY = "10000,30000,20000,80000,60000,93000,55000,500" 
| makemv delim="," SALARY 
| mvexpand SALARY 
| stats count by SALARY 
| sort -SALARY 
| mvcombine SALARY 
| eval SALARY =mvindex(SALARY,2) 
| table SALARY
0 Karma

adonio
Ultra Champion

there are other ways to do this, but in the meantime, try this:

| makeresults count=1
| eval SALARY = "10000,30000,20000,80000,60000,93000,55000"
| makemv delim="," SALARY
| mvexpand SALARY
| rename COMMENT as "the above generates data below is the solution" 
| sort -SALARY
| streamstats count as rec_number
| where rec_number = 3

hope it helps

0 Karma
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...