The totitle function converts a string to title case, capitalizing the first character. Use this function to format display strings, normalize names, or create human-readable output from log data.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, title case conversion typically requires custom functions. APL's totitle provides this functionality natively.
['sample-http-logs']
| extend titlecase = totitle(field)In ANSI SQL, title case conversion varies by database. APL's totitle provides standardized title case conversion.
['sample-http-logs']
| extend titlecase = totitle(field)Usage
Syntax
totitle(value)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| value | string | Yes | The input string to convert to title case. |
Returns
Returns the input string with the first character capitalized.
Use case examples
Format HTTP methods and status codes for human-readable reports.
Query
['sample-http-logs']
| extend formatted_method = totitle(tolower(method))
| summarize request_count = count() by formatted_method, status
| sort by request_count desc
| limit 10Output
| formatted_method | status | request_count |
|---|---|---|
| Get | 200 | 5432 |
| Post | 201 | 2341 |
| Get | 404 | 1987 |
This query formats HTTP methods in title case, making reports and dashboards more professional and easier to read.
Format service names for display in monitoring dashboards.
Query
['otel-demo-traces']
| extend display_name = totitle(['service.name'])
| summarize span_count = count(), avg_duration = avg(duration) by display_name
| sort by span_count desc
| limit 10Output
| display_name | span_count | avg_duration |
|---|---|---|
| Frontend | 4532 | 125ms |
| Checkout | 3421 | 234ms |
| Cart | 2987 | 89ms |
This query formats service names in title case for cleaner presentation in monitoring dashboards and reports.
List of related functions
- tolower: Converts strings to lowercase. Use this before totitle for consistent formatting.
- toupper: Converts strings to uppercase. Use this for fully capitalized output.
- replace_string: Replaces strings. Use this with case functions for text transformation.
- strcat: Concatenates strings. Use this with totitle to build formatted messages.