[Bro] &expire_function Index data type on multi-index table

Jan Grashöfer jan.grashoefer at gmail.com
Sun Jun 4 10:47:56 PDT 2017

Hi Dave,

> With the following table:
> test_expire_table: table[string, addr] of set[string] &write_expire=5sec &expire_func=test_expire_func
> What is the data type for the index variable when the expire function is called?
> function test_expire_func(t: table[string, addr] of set[string], idx: ???): interval
> If I set the idx type to any or string then print idx:
> Test,
> But trying to use it as an index produces an error:

you can use a tuple-like syntax to get the index:

[i, j] = idx

Then you can use each part of the index separately or use both to access
the table (c.f.


More information about the Bro mailing list