tolower

Usage#

Syntax#

tolower(value)

Parameters#

Name	Type	Required	Description
value	string	Yes	The input string to convert to lowercase.

Returns#

Returns the input string with all characters converted to lowercase.

Use case examples#

Log analysisOpenTelemetry traces

Normalize HTTP methods for case-insensitive aggregation and analysis.

Query

['sample-http-logs']
| extend normalized_method = tolower(method)
| summarize request_count = count() by normalized_method, status
| sort by request_count desc
| limit 10

Run in Playground

Output

normalized_method	status	request_count
get	200	5432
post	201	2341
get	404	1987

This query normalizes HTTP methods to lowercase, ensuring that 'GET', 'Get', and 'get' are all counted together for accurate request analysis.

Standardize service names for consistent cross-service analysis.

Query

['otel-demo-traces']
| extend normalized_service = tolower(['service.name'])
| summarize span_count = count(), avg_duration = avg(duration) by normalized_service
| sort by span_count desc
| limit 10

Run in Playground

Output

normalized_service	span_count	avg_duration
frontend	4532	125ms
checkout	3421	234ms
cart	2987	89ms

This query normalizes service names to lowercase, ensuring consistent grouping regardless of naming convention variations.

toupper: Converts strings to uppercase. Use this for the opposite transformation.
totitle: Converts strings to title case. Use this for capitalized word formatting.
strcmp: Compares strings. Use tolower before strcmp for case-insensitive comparisons.
replace_string: Replaces strings. Use tolower to normalize before replacements.

Other query languages#

Splunk SPL users

In Splunk SPL, you use the lower function. APL's tolower provides the same functionality.

Splunk example

| eval lowercase=lower(field)

APL equivalent

['sample-http-logs']
| extend lowercase = tolower(field)

ANSI SQL users

In ANSI SQL, you use LOWER for lowercase conversion. APL's tolower provides the same functionality.

SQL example

SELECT LOWER(field) AS lowercase FROM logs;