Splunk Search

How to convert string data in a field to proper case?

drewski3420
New Member

I'm trying to convert string data in my fields to proper case e.g. josh smith to Josh Smith. Is there any function in Splunk that can do this out of the box? I know there are easy ways to convert to lower and upper but I haven't found anything that will let me convert to proper case.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

View solution in original post

woodcock
Esteemed Legend

Like this:

|makeresults
| eval Name="gregg e. woodcock"
| rex field=Name mode=sed "s/^/ / s/ [aA]/ A/g s/ [bB]/ B/g s/ [cC]/ C/g s/ [dD]/ D/g s/ [eE]/ E/g s/ [fF]/ F/g s/ [gG]/ G/g s/ [hH]/ H/g s/ [iI]/ I/g s/ [jJ]/ J/g s/ [kK]/ K/g s/ [lL]/ L/g s/ [mM]/ M/g s/ [nN]/ N/g s/ [oO]/ O/g s/ [pP]/ P/g s/ [qQ]/ Q/g s/ [rR]/ R/g s/ [sS]/ S/g s/ [tT]/ T/g s/ [uU]/ U/g s/ [vV]/ V/g s/ [wW]/ W/g s/ [xX]/ X/g s/ [yY]/ Y/g s/ [zZ]/ Z/g s/^.//"

landen99
Motivator

What is the purpose of the first and last parts with "^" and "^." ?

woodcock
Esteemed Legend

It was a hack.
The s/^/ / forces the beginning of the string to contain a leading space so that the middle things can correctly determine the beginning of a word being a space followed by anything else. The last s/^.//, which could have been written as s/^ //, is to undo the hack after the middle stuff is done. When stringing SED it goes from left to right.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Hi @drewski,

you can use below as a macro. you just need to pass the field which you want to convert.

Note: It works only for two words and result of this will be word starts with capital letter and single eval is used.

|  makeresults
| eval name="PawaN KaLyaN" 
| eval name = lower(name)
| eval name=upper(substr(mvindex(split(name," "),0),0,1)).substr(mvindex(split(name," "),0),2)." ".upper(substr(mvindex(split(name," "),1),0,1)).substr(mvindex(split(name," "),1),2)

Happy Splunking...

————————————
If this helps, give a like below.
0 Karma

drewski3420
New Member

Thanks for your response. Unfortunately I'm not guaranteed to only get FN LN so I need to develop a more robust solution.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

This isn't a function, but here is an example of how you might do accomplish this.

< YOUR BASE SEARCH> 
| eval name="kevin morris" 
| rex field=name "^(?P<first>\w+)\s(?P<last>\w+)" 
| rex field=first "^(?P<ffirst>.)(?P<lfirst>.*)" 
| rex field=last "^(?P<flast>.)(?P<llast>.*)" 
| eval fullname = upper(ffirst) . lfirst . " " . upper(flast) . llast 
| table fullname
0 Karma

somesoni2
SplunkTrust
SplunkTrust

AFAIK, there is no direct/native way to do so in Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...