The toupper function converts all characters in a string to uppercase. Use this function to normalize text for case-insensitive operations, standardize identifiers, or format strings for emphasis in output.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you use the upper function. APL's toupper provides the same functionality.
['sample-http-logs']
| extend uppercase = toupper(field)In ANSI SQL, you use UPPER for uppercase conversion. APL's toupper provides the same functionality.
['sample-http-logs']
| extend uppercase = toupper(field)Usage
Syntax
toupper(value)Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| value | string | Yes | The input string to convert to uppercase. |
Returns
Returns the input string with all characters converted to uppercase.
Use case examples
Standardize HTTP status codes and methods for consistent alerting and reporting.
Query
['sample-http-logs']
| extend normalized_method = toupper(method)
| extend alert_status = iff(status startswith '5', toupper(strcat('ERROR_', status)), status)
| summarize request_count = count() by normalized_method, alert_status
| sort by request_count desc
| limit 10Output
| normalized_method | alert_status | request_count |
|---|---|---|
| GET | 200 | 5432 |
| POST | 201 | 2341 |
| GET | ERROR_500 | 234 |
This query normalizes HTTP methods to uppercase and creates emphasized error status codes for critical alerts.
Create uppercase service identifiers for system monitoring and alerting.
Query
['otel-demo-traces']
| extend service_code = toupper(substring(['service.name'], 0, 3))
| summarize span_count = count(), avg_duration = avg(duration) by service_code
| sort by span_count desc
| limit 10Output
| service_code | span_count | avg_duration |
|---|---|---|
| FRO | 4532 | 125ms |
| CHE | 3421 | 234ms |
| CAR | 2987 | 89ms |
This query creates three-letter uppercase service codes for compact monitoring displays and alerts.
List of related functions
- tolower: Converts strings to lowercase. Use this for the opposite transformation.
- totitle: Converts strings to title case. Use this for capitalized formatting.
- strcmp: Compares strings. Use toupper before strcmp for case-insensitive comparisons.
- strcat: Concatenates strings. Use this with toupper to build emphasized messages.