lower

lower

📝 String

Convert all alphabetic characters to lowercase

Signature lower(string) → string

Returns

string

The input string with all characters converted to lowercase; null if input is null

The lower function converts the input string to lowercase.

Edge Cases

• If string is null, returns null
• Non-alphabetic characters (numbers, punctuation, spaces) are unchanged
• Works with Unicode characters where case conversion is defined

Examples

| eval user_lower = lower(user)

Creates a new field user_lower with the lowercase version of user, useful for case-insensitive comparisons.

| where lower(status) == "error"

Matches records where status is “error”, “ERROR”, “Error”, etc.

| eval normalized_service = lower(service_name)

Normalizes service names to lowercase for grouping.

Used In

• eval — to create or transform string fields