topic Re: Automatically capitalize the first letter of every word that follows a period? in Splunk Search

Automatically capitalize the first letter of every word that follows a period?

rogue670 — Thu, 21 Sep 2017 23:15:19 GMT

I am looking for the proper SPL to capitalize the first letter of every word that follows a period. I have tried several different ways using the eval/upper command. But can't quite get it right. Any help would be appreciated.

Thanks,

Re: Automatically capitalize the first letter of every word that follows a period?

niketn — Thu, 21 Sep 2017 23:45:30 GMT

@rogue670, Can you add some sample events?

Re: Automatically capitalize the first letter of every word that follows a period?

gcusello — Fri, 22 Sep 2017 06:48:30 GMT

Hi rogue670,
if you have something like " 2017-09-22 09.09.09 this is a test to take the first letter after a period a12345 " and I want to find the " a " letter after the period " after a period " you can use rex command:

 your_search
| rex "after a period (?<letter>\w)"
| ...

Bye.
Giuseppe

Re: Automatically capitalize the first letter of every word that follows a period?

niketn — Fri, 22 Sep 2017 09:58:50 GMT

@rogue670, while this question depends on what data you have, following is a roundabout way for replacing first character of every line to upper case. Due to a limit of 100 events by list() argument for stats command, each one of your event should have maximum 100 lines.

| makeresults 
| eval raw="this is a test string. it has characters after period in lower case.pick up first character after period and convert to upper case.test complete." 
| makemv delim="." raw 
| mvexpand raw
| eval raw=trim(raw)
| eval raw = upper(substr(raw,1,1)).substr(raw,2)."."
| stats list(raw) as raw
| nomv raw

PS: There could be easier more direct approach using rex with sed. However, while I was able to pin point first character of every line which was lower case, I was not able to replace the same with upper case.

Re: Automatically capitalize the first letter of every word that follows a period?

landen99 — Thu, 05 Mar 2020 15:56:34 GMT

I downvoted this post because the question was about capitalizing first letters.

Re: Automatically capitalize the first letter of every word that follows a period?

kulick — Tue, 28 Apr 2020 17:49:10 GMT

How about this SPL leveraging sed-mode of rex...

| makeresults | eval str="The foo is bar.  baz is fine. what?" 
| rex mode=sed field=str "s/\.( +)([a-z])/. \1__\2__/g s/__a__/A/g s/__b__/B/g s/__c__/C/g s/__d__/D/g s/__e__/E/g s/__f__/F/g s/__g__/G/g s/__h__/H/g s/__i__/I/g s/__j__/J/g s/__k__/K/g s/__l__/L/g s/__m__/M/g s/__n__/N/g s/__o__/O/g s/__p__/P/g s/__q__/Q/g s/__r__/R/g s/__s__/S/g s/__t__/T/g s/__u__/U/g s/__v__/V/g s/__w__/W/g s/__x__/X/g s/__y__/Y/g s/__z__/Z/g"

Ugly, but effective. I use a variant (that doesn't require a period) to capitalize every word in a fragment for display in a table.