Splunk Search

Automatically capitalize the first letter of every word that follows a period?

rogue670
Engager

I am looking for the proper SPL to capitalize the first letter of every word that follows a period. I have tried several different ways using the eval/upper command. But can't quite get it right. Any help would be appreciated.

Thanks,

0 Karma

kulick
Path Finder

How about this SPL leveraging sed-mode of rex...

| makeresults | eval str="The foo is bar.  baz is fine. what?" 
| rex mode=sed field=str "s/\.( +)([a-z])/. \1__\2__/g s/__a__/A/g s/__b__/B/g s/__c__/C/g s/__d__/D/g s/__e__/E/g s/__f__/F/g s/__g__/G/g s/__h__/H/g s/__i__/I/g s/__j__/J/g s/__k__/K/g s/__l__/L/g s/__m__/M/g s/__n__/N/g s/__o__/O/g s/__p__/P/g s/__q__/Q/g s/__r__/R/g s/__s__/S/g s/__t__/T/g s/__u__/U/g s/__v__/V/g s/__w__/W/g s/__x__/X/g s/__y__/Y/g s/__z__/Z/g"

Ugly, but effective. I use a variant (that doesn't require a period) to capitalize every word in a fragment for display in a table.

gcusello
SplunkTrust
SplunkTrust

Hi rogue670,
if you have something like " 2017-09-22 09.09.09 this is a test to take the first letter after a period a12345 " and I want to find the " a " letter after the period " after a period " you can use rex command:

 your_search
| rex "after a period (?<letter>\w)"
| ...

Bye.
Giuseppe

0 Karma

landen99
Motivator

I downvoted this post because the question was about capitalizing first letters.

0 Karma

niketn
Legend

@rogue670, Can you add some sample events?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@rogue670, while this question depends on what data you have, following is a roundabout way for replacing first character of every line to upper case. Due to a limit of 100 events by list() argument for stats command, each one of your event should have maximum 100 lines.

| makeresults 
| eval raw="this is a test string. it has characters after period in lower case.pick up first character after period and convert to upper case.test complete." 
| makemv delim="." raw 
| mvexpand raw
| eval raw=trim(raw)
| eval raw = upper(substr(raw,1,1)).substr(raw,2)."."
| stats list(raw) as raw
| nomv raw

PS: There could be easier more direct approach using rex with sed. However, while I was able to pin point first character of every line which was lower case, I was not able to replace the same with upper case.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...