Getting Data In

How to conditionally rename field in array of objects

stenvala
Engager

Hi,

I have query

| makeresults
| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"
| spath
| rename values{}.rank as rank
| rename values{}.value as value
| table name, rank, value

Producing result

screenshot.PNG
Because in the first item of values, value is empty the values in the table are shifted one up and are not aligned with the rank. 

How could I conditionally update the value to, say, [empty] if that is empty string in the data?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Fill in the empty values using the mvmap function.

| makeresults
| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"
| spath
| rename values{}.rank as rank
| rename values{}.value as value
| eval value=mvmap(value,if(value="", "[empty]", value))
| table name, rank, value

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Fill in the empty values using the mvmap function.

| makeresults
| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"
| spath
| rename values{}.rank as rank
| rename values{}.value as value
| eval value=mvmap(value,if(value="", "[empty]", value))
| table name, rank, value

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...