Capitalize the first character of a string value using eval or field format?

[atornes]

How can I capitalize the first character of some string values using one of the eval or fieldformat operators?

[Ayn · Accepted solution]

Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:

... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)

[scentoni_splunk]

Try this

| eval myfield = upper(substr(myfield,1,1)).lower(substr(myfield,2))