Please help me in Finding the 3rd or nth largest value from a field...
SALARY
10000
30000
20000
80000
60000
93000
55000
we need to get 3rd largest as 60000
Please give the spl and help me
Try this-
<your search>| sort -SALARY | streamstats count as rank by SALARY| where rank=3
Hi
Try this
| makeresults
| eval SALARY = "10000,30000,20000,80000,60000,93000,55000,500"
| makemv delim="," SALARY
| mvexpand SALARY
| stats count by SALARY
| sort -SALARY
| mvcombine SALARY
| eval SALARY =mvindex(SALARY,2)
| table SALARY
there are other ways to do this, but in the meantime, try this:
| makeresults count=1
| eval SALARY = "10000,30000,20000,80000,60000,93000,55000"
| makemv delim="," SALARY
| mvexpand SALARY
| rename COMMENT as "the above generates data below is the solution"
| sort -SALARY
| streamstats count as rec_number
| where rec_number = 3
hope it helps