https://community.splunk.com/t5/Getting-Data-In/How-to-conditionally-rename-field-in-array-of-objects/m-p/658273#M111354 <P>Hi,<BR /><BR />I have query</P><P>| makeresults<BR />| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"<BR />| spath<BR />| rename values{}.rank as rank<BR />| rename values{}.value as value<BR />| table name, rank, value<BR /><BR />Producing result</P><P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="screenshot.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27256i7D19977B94FC16A1/image-size/large?v=v2&amp;px=999" role="button" title="screenshot.PNG" alt="screenshot.PNG" /></span><BR />Because in the first item of values, value is empty the values in the table are shifted one up and are not aligned with the rank.&nbsp;<BR /><BR />How could I conditionally update the value to, say, [empty] if that is empty string in the data?</SPAN></P> Thu, 21 Sep 2023 12:20:20 GMT stenvala 2023-09-21T12:20:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-conditionally-rename-field-in-array-of-objects/m-p/658273#M111354 <P>Hi,<BR /><BR />I have query</P><P>| makeresults<BR />| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"<BR />| spath<BR />| rename values{}.rank as rank<BR />| rename values{}.value as value<BR />| table name, rank, value<BR /><BR />Producing result</P><P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="screenshot.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/27256i7D19977B94FC16A1/image-size/large?v=v2&amp;px=999" role="button" title="screenshot.PNG" alt="screenshot.PNG" /></span><BR />Because in the first item of values, value is empty the values in the table are shifted one up and are not aligned with the rank.&nbsp;<BR /><BR />How could I conditionally update the value to, say, [empty] if that is empty string in the data?</SPAN></P> Thu, 21 Sep 2023 12:20:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-conditionally-rename-field-in-array-of-objects/m-p/658273#M111354 stenvala 2023-09-21T12:20:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-conditionally-rename-field-in-array-of-objects/m-p/658291#M111361 <P>Fill in the empty values using the <FONT face="georgia,palatino">mvmap</FONT> function.</P><LI-CODE lang="markup">| makeresults | eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}" | spath | rename values{}.rank as rank | rename values{}.value as value | eval value=mvmap(value,if(value="", "[empty]", value)) | table name, rank, value</LI-CODE><P>&nbsp;</P> Thu, 21 Sep 2023 13:39:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-conditionally-rename-field-in-array-of-objects/m-p/658291#M111361 richgalloway 2023-09-21T13:39:54Z