# In Zeek (e.g. main.zeek), how can I use the variable from another script (e.g .sh file) with packet\_source() or any function?

**URL:** <https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889>\
**Category:** Zeek\
**Created:** [January 17, 2023, 3:03pm UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889 "2023-01-17T15:03:08Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [January 17, 2023, 3:03pm UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/1 "2023-01-17T15:03:08Z")

</div>

My command in the .sh file is running.

The command is: ( **$ZEEK -C -r $i dir** )

**i** : _pcap (file) name_ to be processed

**dir** : _directory_ to be extracted

When the command is running, there are the extract files in desired location. It works pretty well. _But I need that filename in the main.zeek_. The question was that how can i access the filename in the main.zeek (used in the .sh file).

As I learned from here, `packet_source()` function could be called in script. But I can not implement it because I just started using it and I’m trying to get used to the script of Zeek.

In my script (_main.zeek_), after loading script index which contains packet\_source() as the built-in function ( **@load base/bif/zeek.bif.zeek** ), how can i define a variable and use it (`e.g global filename: function packet_source():`, is it valid)?

I would be glad if you help.

---

<div class="post-metadata">

**Author:** ![Benjamin\_Bannier](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/benjamin_bannier/32/595_2.png) [@Benjamin\_Bannier](https://community.zeek.org/u/Benjamin_Bannier)\
**Post date:** [January 17, 2023, 3:16pm UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/2 "2023-01-17T15:16:06Z")

</div>

`packet_source` returns a [`PacketSource`](https://docs.zeek.org/en/master/scripts/base/init-bare.zeek.html#type-PacketSource) value. If its `path` value is set Zeek is reading from a PCAP file.

```plaintext
event zeek_init()
	{
	# Get the current PacketSource.
	local source = packet_source();

	# If the the `path` field of `PacketSource` is set we
	# are reading from an offline PCAP file. Print it.
	if ( source?$path )
		{
		print source$path;
		}
	}

```

---

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [January 18, 2023, 6:07am UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/3 "2023-01-18T06:07:19Z")

</div>

I’m developing the code in the _zeek/base/frameworks/files/main.zeek_. In my script, adding loads are done because of the **packet\_source()** and **zeek\_init()**.

> `@load base/bif/zeek.bif.zeek`  
> `@load base/bif/event.bif.zeek`

Shortly after, I’m adding the event zeek\_init()

> `event zeek_init()`  
> `{`  
> `local filename_source = packet_source();`  
> `}`

Since all the modified variables in the some files are defined **function set\_info(f: fa\_file)**, the check in there is done.

> `if(filename_source?$path)`  
> `{`  
> `f$info=cat(filename_source$path);`  
> `}`

info is defined as

> `info: string &log &optional`.

While other variables can be written to the file, the variable I specified is unfortunately not written and even prevents log files of others from being output. So what am I missing? @Benjamin_Bannier

---

<div class="post-metadata">

**Author:** ![Christian](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/christian/32/593_2.png) [@Christian](https://community.zeek.org/u/Christian)\
**Post date:** [January 18, 2023, 6:38am UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/4 "2023-01-18T06:38:52Z")

</div>

Hi there,

It’d really help to see a minimal, runnable example so we can iterate on something reproducible.

A few tips:

- You should not edit the scripts below `scripts/base` because doing so will prevent you from shipping your changes independently from the Zeek distribution in a Zeek package. Try writing your code based on your own event handlers instead, just like the `main.zeek` you’re looking at.
- You’re defining `filename_source` as a variable local to your `zeek_init` handler, so you cannot have it available in `set_info` — I suspect you’re either using a global or calling `packet_source()` again somewhere (which should be fine).
- The `path` member of the `PacketSource` record is already a string, so you can just say `f$info = filename_source$path`.

> and even prevents log files of others from being output

That’s a red flag — I suspect Zeek exited or reported warnings, perhaps based on grammatical or runtime errors in your script.

Best,  
Christian

---

<div class="post-metadata">

**Author:** ![SFD](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@SFD](https://community.zeek.org/u/SFD)\
**Post date:** [January 20, 2023, 12:20pm UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/5 "2023-01-20T12:20:36Z")

</div>

Thanks for your help. I am really appreciated. @Benjamin_Bannier @Christian

The problem was solved and I got the value I wanted. 🙂

---

<div class="post-metadata">

**Author:** ![Jems](https://avatars.discourse-cdn.com/v4/letter/j/41988e/32.png) [@Jems](https://community.zeek.org/u/Jems)\
**Post date:** [March 28, 2023, 12:37am UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/6 "2023-03-28T00:37:46Z")

</div>

The extracted files are present in the intended directory after the command has completed. It functions fairly well. But in the main, I require that filename. zeek. How can I get the filename in the main? was the query[.](https://faisalkiani.com/fake-people-quotes/)

---

<div class="post-metadata">

**Author:** ![Jems](https://avatars.discourse-cdn.com/v4/letter/j/41988e/32.png) [@Jems](https://community.zeek.org/u/Jems)\
**Post date:** [June 18, 2023, 7:26am UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/7 "2023-06-18T07:26:09Z")

</div>

As I learned from here, packet\_source() function could be called in script. But I can not implement it because I just started using it and I’m trying to get used to the script of Zeek[.](https://overplugged.org/)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [April 20, 2026, 9:31pm UTC](https://community.zeek.org/t/in-zeek-e-g-main-zeek-how-can-i-use-the-variable-from-another-script-e-g-sh-file-with-packet-source-or-any-function/6889/8 "2026-04-20T21:31:26Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.