[Bro] Reading a table from an external file

[Earl Eiland]

Thanks, Robin.

I don't see the path you mention below on github.  How do I find it?

Earl

-----Original Message-----
From: Robin Sommer [mailto:robin at icir.org] 
Sent: Friday, July 31, 2015 9:53 AM
To: Earl Eiland <earl.eiland at root9b.com>
Cc: bro at bro.org
Subject: Re: [Bro] Reading a table from an external file



On Thu, Jul 30, 2015 at 19:47 +0000, you wrote:

> Naturally, I can't follow the example.  My table will have three 
> fields, all of which are sets.  How can I read in sets?

Take a look at the test in
testing/btest/scripts/base/frameworks/input/setseparator.bro, that reads in a set, using '|' as the element separator. (If you don't set that explicitly, it's comma instead.)

Btw, the test suite has a bunch of more tests for the input framework, which can provide inspiration for more involved use cases that aren't covered elsewhere.

Robin

--
Robin Sommer * ICSI/LBNL * robin at icir.org * www.icir.org/robin