Splunk Search

How to convert string data in a field to proper case?

drewski3420
New Member

I'm trying to convert string data in my fields to proper case e.g. josh smith to Josh Smith. Is there any function in Splunk that can do this out of the box? I know there are easy ways to convert to lower and upper but I haven't found anything that will let me convert to proper case.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

landen99
Motivator

What is the purpose of the first and last parts with "^" and "^." ?

woodcock
Esteemed Legend

It was a hack.
The s/^/ / forces the beginning of the string to contain a leading space so that the middle things can correctly determine the beginning of a word being a space followed by anything else. The last s/^.//, which could have been written as s/^ //, is to undo the hack after the middle stuff is done. When stringing SED it goes from left to right.

0 Karma

thambisetty
Super Champion

Hi @drewski,

you can use below as a macro. you just need to pass the field which you want to convert.

Note: It works only for two words and result of this will be word starts with capital letter and single eval is used.

|  makeresults
| eval name="PawaN KaLyaN" 
| eval name = lower(name)
| eval name=upper(substr(mvindex(split(name," "),0),0,1)).substr(mvindex(split(name," "),0),2)." ".upper(substr(mvindex(split(name," "),1),0,1)).substr(mvindex(split(name," "),1),2)

Happy Splunking...

————————————
If this helps, give a like below.
0 Karma

drewski3420
New Member

Thanks for your response. Unfortunately I'm not guaranteed to only get FN LN so I need to develop a more robust solution.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

This isn't a function, but here is an example of how you might do accomplish this.

< YOUR BASE SEARCH> 
| eval name="kevin morris" 
| rex field=name "^(?P<first>\w+)\s(?P<last>\w+)" 
| rex field=first "^(?P<ffirst>.)(?P<lfirst>.*)" 
| rex field=last "^(?P<flast>.)(?P<llast>.*)" 
| eval fullname = upper(ffirst) . lfirst . " " . upper(flast) . llast 
| table fullname
0 Karma

somesoni2
Revered Legend

AFAIK, there is no direct/native way to do so in Splunk.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...