convertHostNameToIp function is not working, shows validation failed

[GodOfDistroyer]

Hi Team,

     While I am trying to make a custom parser for Windows/any other device type while using the convertHostNameToIp function with setEventAttribute, validation shows failed.

Full function is below:

<setEventAttribute attr="srcIpAddr">convertHostNameToIp($_saddr)</setEventAttribute>

Below is my custom parser for testing. 

While testing with other functions like 

resolveDNSName

All other functions are working fine except convertHostNameToIp. Please give me any suggestions for this issue.

Below is my custom parser.

Validation failed: convertHostNameToIp
<eventFormatRecognizer>TMSSQLSERVER</eventFormatRecognizer>
<parsingInstructions>
<collectAndSetAttrByKeyValuePair sep=" " src="$_rawmsg">
<attrKeyMap attr="hostName" key="Host: "/>
</collectAndSetAttrByKeyValuePair>
<setEventAttribute attr="srcIpAddr">convertHostNameToIp($hostName)</setEventAttribute>
</parsingInstructions>

Validation is passed: resolveDNSName
<eventFormatRecognizer>TMSSQLSERVER</eventFormatRecognizer>
<parsingInstructions>
<collectAndSetAttrByKeyValuePair sep=" " src="$_rawmsg">
<attrKeyMap attr="hostName" key="Host: "/>
</collectAndSetAttrByKeyValuePair>
<setEventAttribute attr="destIpAddr">resolveDNSName($hostName)</setEventAttribute>
</parsingInstructions>

@AEK, @Toshi_Esumi, @ozkanaltas

[AEK · Accepted solution]

Hello

It seems this function is deprecated and should use resolveDNSName instead.

https://docs.fortinet.com/index.php/document/fortisiem/7.3.4/user-guide/962586

Hope it helps.

[GodOfDistroyer]

Thank you for sharing the solution. Your support is much appreciated