# bro script q.

**URL:** <https://community.zeek.org/t/bro-script-q/4401>\
**Category:** Zeek\
**Created:** [October 7, 2016, 9:00pm UTC](https://community.zeek.org/t/bro-script-q/4401 "2016-10-07T21:00:05Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dk\_Jack](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Dk\_Jack](https://community.zeek.org/u/Dk_Jack)\
**Post date:** [October 7, 2016, 9:00pm UTC](https://community.zeek.org/t/bro-script-q/4401/1 "2016-10-07T21:00:05Z")

</div>

Hi,  
Can a function defined in one script be accessed from another script? Currently, I have the following in two files:

File A:

global myfunc: function(c: connection, msg: string): string

function myfunc(c: connection, msg: string): string  
{  
…  
print fmt(“myfunc: called from %s”, msg);  
…  
return mystring;  
}

event someEventA(c: connection, …)  
{  
…  
c$fileA$myfunc\_result = myfunc(c, “fileA”);  
}

File B:

global myfunc: function(c: connection, msg: string): string

even someEventB(c: connection, …)  
{  
…  
c$fileB$myfunc\_result = myfunc(c, “fileB”);  
…  
}

This compiles and runs fine when I run against a pcap. The events ‘someEventA’ and ‘someEventB’ write to two different log files. In log fileA, I see all the columns populated include myfunc\_result column. However, in log fileB, I the myfunc\_result shows the default string ‘NA’. In the standard out file, I only see ‘myfunc: called from fileA’ messages.

Since the myfunc function is performing a lookup on a table (loaded from file on disk), I’d like both the events to be able to see the same info. What am I doing wrong which is preventing me from accessing myfunc function from fileB. Thanks.

Dk.

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [October 7, 2016, 9:24pm UTC](https://community.zeek.org/t/bro-script-q/4401/2 "2016-10-07T21:24:35Z")

</div>

In your example you’re defining the same function twice within the global namespace. This might be causing an issue.  
Try using the module and export functionality of the scripting language.

-AK

---

<div class="post-metadata">

**Author:** ![Dk\_Jack](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Dk\_Jack](https://community.zeek.org/u/Dk_Jack)\
**Post date:** [October 7, 2016, 10:30pm UTC](https://community.zeek.org/t/bro-script-q/4401/3 "2016-10-07T22:30:04Z")

</div>

Could you direct me to an example on how to do that? I’ve only seen export being used with export info records… thanks.

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [October 8, 2016, 12:08am UTC](https://community.zeek.org/t/bro-script-q/4401/4 "2016-10-08T00:08:37Z")

</div>

Look at this script. It does things with PE files.

[https://github.com/bro/bro/blob/master/scripts/base/files/pe/main.bro](https://github.com/bro/bro/blob/master/scripts/base/files/pe/main.bro)

Someone may want to correct me here:  
Line 1 declares a new module, which I believe is analogous to C++ namespaces, named “PE”. The export at line 5 declares exported things under the PE namespace. So, to reference the event log\_pe from the global namespace, as your script is doing, it would need to use PE::log\_pe().  
Try exporting your function with a module name declared above it.

-AK

---

<div class="post-metadata">

**Author:** ![Dk\_Jack](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@Dk\_Jack](https://community.zeek.org/u/Dk_Jack)\
**Post date:** [October 8, 2016, 12:16am UTC](https://community.zeek.org/t/bro-script-q/4401/5 "2016-10-08T00:16:55Z")

</div>

Thanks,  
I figured it after sending the email. Thanks.

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [October 8, 2016, 2:42am UTC](https://community.zeek.org/t/bro-script-q/4401/6 "2016-10-08T02:42:51Z")

</div>

Was that your issue? If you want to PM me your scripts I can take a look.

-AK

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/bro-script-q/4401/7 "2022-05-06T15:44:07Z")

</div>

Closed on May 6, 2022, 3:44pm UTC