toupper

Usage#

Syntax#

toupper(value)

Parameters#

Name	Type	Required	Description
value	string	Yes	The input string to convert to uppercase.

Returns#

Returns the input string with all characters converted to uppercase.

Use case examples#

Log analysisOpenTelemetry traces

Standardize HTTP status codes and methods for consistent alerting and reporting.

Query

['sample-http-logs']
| extend normalized_method = toupper(method)
| extend alert_status = iff(status startswith '5', toupper(strcat('ERROR_', status)), status)
| summarize request_count = count() by normalized_method, alert_status
| sort by request_count desc
| limit 10

Run in Playground

Output

normalized_method	alert_status	request_count
GET	200	5432
POST	201	2341
GET	ERROR_500	234

This query normalizes HTTP methods to uppercase and creates emphasized error status codes for critical alerts.

Create uppercase service identifiers for system monitoring and alerting.

Query

['otel-demo-traces']
| extend service_code = toupper(substring(['service.name'], 0, 3))
| summarize span_count = count(), avg_duration = avg(duration) by service_code
| sort by span_count desc
| limit 10

Run in Playground

Output

service_code	span_count	avg_duration
FRO	4532	125ms
CHE	3421	234ms
CAR	2987	89ms

This query creates three-letter uppercase service codes for compact monitoring displays and alerts.

tolower: Converts strings to lowercase. Use this for the opposite transformation.
totitle: Converts strings to title case. Use this for capitalized formatting.
strcmp: Compares strings. Use toupper before strcmp for case-insensitive comparisons.
strcat: Concatenates strings. Use this with toupper to build emphasized messages.

Other query languages#

Splunk SPL users

In Splunk SPL, you use the upper function. APL's toupper provides the same functionality.

Splunk example

| eval uppercase=upper(field)

APL equivalent

['sample-http-logs']
| extend uppercase = toupper(field)

ANSI SQL users

In ANSI SQL, you use UPPER for uppercase conversion. APL's toupper provides the same functionality.

SQL example

SELECT UPPER(field) AS uppercase FROM logs;