I am trying to create reports off the DMARC reports uploaded by this app. It seems that some DMARC reported capitalize some value in the XML fields, for example:
policy_published_domain - All caps or all lower
row_policy_evaluated_dkim - Some capitalize the first letter
row_policy_evaluated_spf - Some capitalize the first letter
Could we have the code that converts the XML to Splunk friendly data lowercase all of the data? I do not see any fields that would be case sensitive. It is awkward and CPU intensive to do eval lowers on all the fields in Splunk.
I am trying to create reports off the DMARC reports uploaded by this app. It seems that some DMARC reported capitalize some value in the XML fields, for example:
Could we have the code that converts the XML to Splunk friendly data lowercase all of the data? I do not see any fields that would be case sensitive. It is awkward and CPU intensive to do eval lowers on all the fields in Splunk.