How to convert string data in a field to proper case?

[drewski3420]

I'm trying to convert string data in my fields to proper case e.g. josh smith to Josh Smith. Is there any function in Splunk that can do this out of the box? I know there are easy ways to convert to lower and upper but I haven't found anything that will let me convert to proper case.

[woodcock · Accepted solution]

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

[landen99]

What is the purpose of the first and last parts with "^" and "^." ?

[woodcock]

It was a hack.
The s/^/ / forces the beginning of the string to contain a leading space so that the middle things can correctly determine the beginning of a word being a space followed by anything else. The last s/^.//, which could have been written as s/^ //, is to undo the hack after the middle stuff is done. When stringing SED it goes from left to right.

[thambisetty]

Hi @drewski,

you can use below as a macro. you just need to pass the field which you want to convert.

Note: It works only for two words and result of this will be word starts with capital letter and single eval is used.

|  makeresults
| eval name="PawaN KaLyaN" 
| eval name = lower(name)
| eval name=upper(substr(mvindex(split(name," "),0),0,1)).substr(mvindex(split(name," "),0),2)." ".upper(substr(mvindex(split(name," "),1),0,1)).substr(mvindex(split(name," "),1),2)

Happy Splunking...

[drewski3420]

Thanks for your response. Unfortunately I'm not guaranteed to only get FN LN so I need to develop a more robust solution.

[kmorris_splunk]

This isn't a function, but here is an example of how you might do accomplish this.

< YOUR BASE SEARCH> 
| eval name="kevin morris" 
| rex field=name "^(?P<first>\w+)\s(?P<last>\w+)" 
| rex field=first "^(?P<ffirst>.)(?P<lfirst>.*)" 
| rex field=last "^(?P<flast>.)(?P<llast>.*)" 
| eval fullname = upper(ffirst) . lfirst . " " . upper(flast) . llast 
| table fullname

[somesoni2]

AFAIK, there is no direct/native way to do so in Splunk.