All Apps and Add-ons

Add spaces before capital letters in camel case string

Utkarsh_
Explorer

I have a field in which values are in the camel case. I want them to be in proper format with spaces between each word.

For example in the below table:

Porter
AddressUnlocatable_
RestrictedAreaAM_

CustomerShifted_

 

I want its values to be like:

Porter
Address Unlocatable
Restricted Area AM

Customer Shifted

 

I have tried this:

| rex field=Porter mode=sed "s/_//g s/A/ A/g s/B/ B/g s/C/ C/g s/D/ D/g s/E/ E/g s/F/ F/g s/G/ G/g s/H/ H/g s/I/ I/g s/J/ J/g s/K/ K/g s/L/ L/g s/M/ M/g s/N/ N/g s/O/ O/g s/P/ P/g s/Q/ Q/g s/R/ R/g s/S/ S/g s/T/ T/g s/U/ U/g s/V/ V/g s/W/ W/g s/X/ X/g s/Y/ Y/g s/Z/ Z/g s/A M/AM/g"
| eval Porter=trim(Porter)

 

 

This is working fine but it is making my queries very long. Can anyone suggest a smaller query to do the same?

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Porter mode=sed "s/(?<capital>[A-Z]+)/ \1/g s/_//g"
| eval Porter=trim(Porter)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Porter mode=sed "s/(?<capital>[A-Z]+)/ \1/g s/_//g"
| eval Porter=trim(Porter)
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...