I have a JSON string as an event in Splunk below: {"Item1":{"Max":100,"Remaining":80},"Item2":{"Max":409,"Remaining":409},"Item3":{"Max":200,"Remaining":100},"Item4":{"Max":5,"Remaining":5},"Item5":{"Max":2,"Remaining":2}} Splunk can get fields like "Item1.Max" etc, but when I tried to calculate "Item1.Remaining"/"Item1.Max", it doesn't recognize it as numbers. The convert or tonumber function doesn't work on them. Also how to convert the string to table like below? Items Max Remaining Percentage Item1 100 80 80 Item2 409 409 100 Item3 200 100 50 Item4 5 5 100 Item5 2 2 100 ... View more

I have two multivalue fields that are obtained off JSON object. One field has Name, one field has (numeric) Value. I'd like to sort base off NUMERIC values of the Value field, not Lexicographical order, and table name and value fields by highest numeric value first. Is there a way to do this in Splunk? ... View more