0 Replies Latest reply on Oct 14, 2015 9:15 AM by rorik.koster

    McAfee ESM parsing data to lowercase

    rorik.koster

      I've been looking for a way to match inbound syslog messages containing e-mail addresses and then perform a 'lowercase' operation (equivalent to perl's 'lc' function) on the matched string before it is stored, or while it is stored, as a field match. 

       

      As an example:  John.Smith@domain.xyz should be stored as john.smith@domain.xyz.

       

      Any suggestions?