Splunk Search

Capitalize the first character of a string value using eval or field format?

atornes
Path Finder

How can I capitalize the first character of some string values using one of the eval or fieldformat operators?

Tags (3)
1 Solution

Ayn
Legend

Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:

... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)

View solution in original post

Ayn
Legend

Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:

... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)

scentoni_splunk
Splunk Employee
Splunk Employee

Try this

| eval myfield = upper(substr(myfield,1,1)).lower(substr(myfield,2))
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...