[Bro] &write_expire functionality

[Seth Hall]

Whoops, I replied off list.  For everyone else's sake, here's what I 
came to based on digging around a bit...

It doesn't work that way. You may want to change the record and then 
save the record back to the table. The snippet would look like this

```bro
local x = my_table[index_value];
x$fieldname += 1;
my_table[index_value] = x;
```

That should make the timeouts work right. :)

    .Seth

On 30 Oct 2017, at 13:38, Seth Hall wrote:

> Unfortunately I don't think it will.  Mutable types break some 
> assumptions in Bro and this is one of them.  I will do some testing 
> this afternoon to verify if that's actually true though.
>
>   .Seth
>
> On 30 Oct 2017, at 13:20, Lamps, Jereme wrote:
>
>> If I have:
>> global my_table: table[string] of vector of HTTP::Info &write_expire 
>> = 5mins;
>> Will the timeout reset for a particular string entry if I modify a 
>> single element within one of the HTTP::Info records?
>>
>> Best,
>>
>> Jereme
>
>
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
> --
> Seth Hall * Corelight, Inc * www.corelight.com



--
Seth Hall * Corelight, Inc * www.corelight.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20171030/d41c3255/attachment.html