How to conditionally rename field in array of objects

[stenvala]

Hi,

I have query

| makeresults
| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"
| spath
| rename values{}.rank as rank
| rename values{}.value as value
| table name, rank, value

Producing result

Because in the first item of values, value is empty the values in the table are shifted one up and are not aligned with the rank. 

How could I conditionally update the value to, say, [empty] if that is empty string in the data?

[richgalloway · Accepted solution]

Fill in the empty values using the mvmap function.

| makeresults
| eval _raw="{\"name\": \"my name\", \"values\": [{\"rank\": 1, \"value\": \"\"}, {\"rank\": 2, \"value\": \"a\"}, {\"rank\": 3, \"value\": \"b\"}, {\"rank\": 4, \"value\": \"c\"}]}"
| spath
| rename values{}.rank as rank
| rename values{}.value as value
| eval value=mvmap(value,if(value="", "[empty]", value))
| table name, rank, value