topic Re: Splunk search- How to capitalize the first letter of every filed column? in Splunk Search

Splunk search- How to capitalize the first letter of every filed column?

uagraw01 — Thu, 15 Sep 2022 15:20:49 GMT

Hello Splunkers !!

As per the below screenshot I want to capitalise the first letter of every filed column.So for the same I have tried above work around which are in commented. Please suggest me how can I Capitalise first letter of every field name.

Re: Splunk search- How to capitalize the first letter of every filed column?

uagraw01 — Fri, 16 Sep 2022 04:15:00 GMT

Please provide me any suggestion on the below post.

As per below example like First letter should be in Capital.

Current "vulnablities ", groups

expection : "Vulnablities" , "Groups"

Re: Splunk search- How to capitalize the first letter of every filed column?

VatsalJagani — Fri, 16 Sep 2022 04:36:30 GMT

@uagraw01 - In your search, it seems the easiest option to do that is to just write field names the way you want in the stats command itself. Like,

| stats dc(falcon.vul.cve.id) as Vulnerabilities, dc(host.info.id) as Groups .....

I hope this helps!!!

Re: Splunk search- How to capitalize the first letter of every filed column?

uagraw01 — Fri, 16 Sep 2022 04:43:19 GMT

@VatsalJagani Thank you vatsal for your response.

Just for my knowledge can you help me, how can I achieve this by using eval function?

Re: Splunk search- How to capitalize the first letter of every filed column?

VatsalJagani — Fri, 16 Sep 2022 05:02:17 GMT

@uagraw01 - Here is how you can do that without explicitly specifying the field name. It applies to all the present fields.

| foreach * [ | eval field_<<FIELD>> = "<<FIELD>>" | eval field_<<FIELD>> = upper(substr(field_<<FIELD>>,1,1)).substr(field_<<FIELD>>,2) | eval {field_<<FIELD>>} = <<FIELD>> | fields - field_<<FIELD>>, <<FIELD>>]

Here is full example:

| makeresults | eval vulnerabilities=10, groups=2 | append [| makeresults | eval vulnerabilities=9, groups=4] | foreach * [ | eval field_<<FIELD>> = "<<FIELD>>" | eval field_<<FIELD>> = upper(substr(field_<<FIELD>>,1,1)).substr(field_<<FIELD>>,2) | eval {field_<<FIELD>>} = <<FIELD>> | fields - field_<<FIELD>>, <<FIELD>>]

I hope this helps!!! Please upvote & accept the answer if it answers your question!!!

Re: Splunk search- How to capitalize the first letter of every filed column?

uagraw01 — Fri, 16 Sep 2022 06:08:26 GMT

@VatsalJagani Thanks for your response.

Re: Splunk search- How to capitalize the first letter of every filed column?

VatsalJagani — Fri, 16 Sep 2022 06:22:32 GMT

@uagraw01 - If it answers your question, please mark it as an accepted answer by clicking on "Accept as Solution".