How can I capitalize the first character of some string values using one of the eval or fieldformat operators?
Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:
... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)
Off the top of my head (I have no Splunk instance to try this on at the moment), this should do it:
... | eval myfield = upper(substr(myfield,1,1)).substr(myfield,2)
Try this
| eval myfield = upper(substr(myfield,1,1)).lower(substr(myfield,2))