convertHostNameToIp function is not working, shows validation failed
Hi Team,
While I am trying to make a custom parser for Windows/any other device type while using the convertHostNameToIp function with setEventAttribute, validation shows failed.
Full function is below:
<setEventAttribute attr="srcIpAddr">convertHostNameToIp($_saddr)</setEventAttribute>
Below is my custom parser for testing.
While testing with other functions like
resolveDNSName
All other functions are working fine except convertHostNameToIp. Please give me any suggestions for this issue.
Below is my custom parser.
Validation failed: convertHostNameToIp
<eventFormatRecognizer>TMSSQLSERVER</eventFormatRecognizer>
<parsingInstructions>
<collectAndSetAttrByKeyValuePair sep=" " src="$_rawmsg">
<attrKeyMap attr="hostName" key="Host: "/>
</collectAndSetAttrByKeyValuePair>
<setEventAttribute attr="srcIpAddr">convertHostNameToIp($hostName)</setEventAttribute>
</parsingInstructions>
Validation is passed: resolveDNSName
<eventFormatRecognizer>TMSSQLSERVER</eventFormatRecognizer>
<parsingInstructions>
<collectAndSetAttrByKeyValuePair sep=" " src="$_rawmsg">
<attrKeyMap attr="hostName" key="Host: "/>
</collectAndSetAttrByKeyValuePair>
<setEventAttribute attr="destIpAddr">resolveDNSName($hostName)</setEventAttribute>
</parsingInstructions>