[Bro] &expire_function Index data type on multi-index table

Jan Grashöfer jan.grashoefer at gmail.com
Sun Jun 4 10:47:56 PDT 2017


Hi Dave,

> With the following table:
> 
> test_expire_table: table[string, addr] of set[string] &write_expire=5sec &expire_func=test_expire_func
> 
> What is the data type for the index variable when the expire function is called?
> 
> function test_expire_func(t: table[string, addr] of set[string], idx: ???): interval
> 
> If I set the idx type to any or string then print idx:
> 
> Test, 1.2.3.4
> 
> But trying to use it as an index produces an error:

you can use a tuple-like syntax to get the index:

[i, j] = idx

Then you can use each part of the index separately or use both to access
the table (c.f.
https://github.com/bro/bro/blob/master/scripts/base/frameworks/intel/main.bro#L254).

Jan


More information about the Bro mailing list