Splunk Search

Capitalize the first character of a string value using eval or field format?

atornes
Path Finder

How can I capitalize the first character of some string values using one of the eval or fieldformat operators?

Tags (3)
1 Solution

Ayn
Legend

Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:

... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)

View solution in original post

Ayn
Legend

Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:

... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)

scentoni_splunk
Splunk Employee
Splunk Employee

Try this

| eval myfield = upper(substr(myfield,1,1)).lower(substr(myfield,2))
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...