Skip to main content
The totitle function converts a string to title case, capitalizing the first character. Use this function to format display strings, normalize names, or create human-readable output from log data.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, title case conversion typically requires custom functions. APL’s totitle provides this functionality natively.
| eval titlecase=upper(substr(field,1,1)).lower(substr(field,2))
In ANSI SQL, title case conversion varies by database. APL’s totitle provides standardized title case conversion.
SELECT INITCAP(field) AS titlecase FROM logs;

Usage

Syntax

totitle(value)

Parameters

NameTypeRequiredDescription
valuestringYesThe input string to convert to title case.

Returns

Returns the input string with the first character capitalized.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Format HTTP methods and status codes for human-readable reports.Query
['sample-http-logs']
| extend formatted_method = totitle(tolower(method))
| summarize request_count = count() by formatted_method, status
| sort by request_count desc
| limit 10
Run in PlaygroundOutput
formatted_methodstatusrequest_count
Get2005432
Post2012341
Get4041987
This query formats HTTP methods in title case, making reports and dashboards more professional and easier to read.
  • tolower: Converts strings to lowercase. Use this before totitle for consistent formatting.
  • toupper: Converts strings to uppercase. Use this for fully capitalized output.
  • replace_string: Replaces strings. Use this with case functions for text transformation.
  • strcat: Concatenates strings. Use this with totitle to build formatted messages.