[Bro] &expire_function Index data type on multi-index table
Jan Grashöfer
jan.grashoefer at gmail.com
Sun Jun 4 10:47:56 PDT 2017
Hi Dave,
> With the following table:
>
> test_expire_table: table[string, addr] of set[string] &write_expire=5sec &expire_func=test_expire_func
>
> What is the data type for the index variable when the expire function is called?
>
> function test_expire_func(t: table[string, addr] of set[string], idx: ???): interval
>
> If I set the idx type to any or string then print idx:
>
> Test, 1.2.3.4
>
> But trying to use it as an index produces an error:
you can use a tuple-like syntax to get the index:
[i, j] = idx
Then you can use each part of the index separately or use both to access
the table (c.f.
https://github.com/bro/bro/blob/master/scripts/base/frameworks/intel/main.bro#L254).
Jan
More information about the Bro
mailing list