[Bro-Dev] Writing SumStats plugin

Jon Siwek jsiwek at corelight.com
Mon Aug 13 16:06:52 PDT 2018

On Tue, Aug 7, 2018 at 5:15 PM Jim Mellander <jmellander at lbl.gov> wrote:

> Incidentally, I think theres a bug in the observe() function:
> These two lines are run in the loop thru the reducers:
>                if ( r?$normalize_key )
>                         key = r$normalize_key(copy(key));
> which has the effect of modifying the key for subsequent loops, rather than just for the one reducer it applies to.  The fix is easy and and obvious....

Yeah, looked wrong to me also.  Fixed via [1] in master branch now.
Sorry I don't have much knowledge of the existing sumstats code to
drive the other discussion/suggestions forward.

- Jon


More information about the bro-dev mailing list