The tolower function converts all characters in a string to lowercase. Use this function to normalize text for case-insensitive comparisons, standardize log data, or prepare strings for consistent analysis.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use the lower function. APL's tolower provides the same functionality.
['sample-http-logs']
| extend lowercase = tolower(field)In ANSI SQL, you use LOWER for lowercase conversion. APL's tolower provides the same functionality.
['sample-http-logs']
| extend lowercase = tolower(field)Usage
Syntax
tolower(value)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| value | string | Yes | The input string to convert to lowercase. |
Returns
Returns the input string with all characters converted to lowercase.
Use case examples
Normalize HTTP methods for case-insensitive aggregation and analysis.
Query
['sample-http-logs']
| extend normalized_method = tolower(method)
| summarize request_count = count() by normalized_method, status
| sort by request_count desc
| limit 10Output
| normalized_method | status | request_count |
|---|---|---|
| get | 200 | 5432 |
| post | 201 | 2341 |
| get | 404 | 1987 |
This query normalizes HTTP methods to lowercase, ensuring that 'GET', 'Get', and 'get' are all counted together for accurate request analysis.
Standardize service names for consistent cross-service analysis.
Query
['otel-demo-traces']
| extend normalized_service = tolower(['service.name'])
| summarize span_count = count(), avg_duration = avg(duration) by normalized_service
| sort by span_count desc
| limit 10Output
| normalized_service | span_count | avg_duration |
|---|---|---|
| frontend | 4532 | 125ms |
| checkout | 3421 | 234ms |
| cart | 2987 | 89ms |
This query normalizes service names to lowercase, ensuring consistent grouping regardless of naming convention variations.
List of related functions
- toupper: Converts strings to uppercase. Use this for the opposite transformation.
- totitle: Converts strings to title case. Use this for capitalized word formatting.
- strcmp: Compares strings. Use tolower before strcmp for case-insensitive comparisons.
- replace_string: Replaces strings. Use tolower to normalize before replacements.