[Bro] Load Single Column Table with Input Framework

Seth Hall seth at icir.org
Wed Nov 6 10:06:49 PST 2013

On Nov 6, 2013, at 12:51 PM, Chris Crawford <christopher.p.crawford at gmail.com> wrote:

> I expected print(|blacklist|) to print out 3.
> I know I must be missing something simple.  What am I missing?  How should I read in a single column table?

The input framework is asynchronous.  You are printing before that data has been loaded in.  You could try waiting a moment (by scheduling an event perhaps) and checking again.

event try_again()
	print |blacklist|;

event bro_init() 
        Input::add_table([$source="blacklist.file", $name="blacklist", $idx=Idx, $destination=blacklist]);
	schedule 2secs { try_again() };


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20131106/986ca599/attachment.bin 

More information about the Bro mailing list