Splunk Search

how to find third largest salary from a salary field

Tamilraj28
Engager

Please help me in Finding the 3rd or nth largest value from a field...

SALARY

10000
30000
20000
80000
60000
93000
55000

we need to get 3rd largest as 60000

Please give the spl and help me

Tags (1)
0 Karma

Vijeta
Influencer

Try this-

<your search>| sort -SALARY | streamstats count as rank  by SALARY| where rank=3
0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults
| eval SALARY = "10000,30000,20000,80000,60000,93000,55000,500" 
| makemv delim="," SALARY 
| mvexpand SALARY 
| stats count by SALARY 
| sort -SALARY 
| mvcombine SALARY 
| eval SALARY =mvindex(SALARY,2) 
| table SALARY
0 Karma

adonio
Ultra Champion

there are other ways to do this, but in the meantime, try this:

| makeresults count=1
| eval SALARY = "10000,30000,20000,80000,60000,93000,55000"
| makemv delim="," SALARY
| mvexpand SALARY
| rename COMMENT as "the above generates data below is the solution" 
| sort -SALARY
| streamstats count as rec_number
| where rec_number = 3

hope it helps

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...