# Load Single Column Table with Input Framework

**URL:** <https://community.zeek.org/t/load-single-column-table-with-input-framework/2888>\
**Category:** Zeek\
**Created:** [November 6, 2013, 5:51pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888 "2013-11-06T17:51:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Crawford](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Chris\_Crawford](https://community.zeek.org/u/Chris_Crawford)\
**Post date:** [November 6, 2013, 5:51pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888/1 "2013-11-06T17:51:28Z")

</div>

I’m following the tutorial on the input framework:  
[http://www.bro.org/sphinx/input.html](http://www.bro.org/sphinx/input.html)

Everything works great. But, if my blacklist is only one column (i.e. I remove the other columns so that I’m only left with the “ip” column), I run into issues.

The docs for Input::add\_table say that val is optional:

val: `any` `&optional`

Record that defines the values used as the elements of the table If val is undefined, destination has to be a set.

So, I fixed my script to look like this:  
\<new\_script\>

type Idx: record {  
ip: addr;  
};

global blacklist: set[addr];

event bro\_init() {  
Input::add\_table([$source=“blacklist.file”, $name=“blacklist”, $idx=Idx, $destination=blacklist]);  
print(|blacklist|);  
Input::remove(“blacklist”);  
}

\</new\_script\>

No more val and changed the table to a set of addr.

The size for blacklist that gets printed out is 0, even though blacklist.file looks like this:

\<blacklist.file\>  
#fields ip  
#types addr  
192.168.17.1  
192.168.27.2  
192.168.250.3

\</blacklist.file\>

I expected print(|blacklist|) to print out 3.

I know I must be missing something simple. What am I missing? How should I read in a single column table?

-Chris

---

<div class="post-metadata">

**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\
**Post date:** [November 6, 2013, 6:05pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888/2 "2013-11-06T18:05:54Z")

</div>

```auto
The table doesn't get loaded immediately. There is an "input file loaded" event you can print from, or for testing try using bro_done
```

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [November 6, 2013, 6:06pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888/3 "2013-11-06T18:06:49Z")

</div>

The input framework is asynchronous. You are printing before that data has been loaded in. You could try waiting a moment (by scheduling an event perhaps) and checking again.

event try\_again()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;print |blacklist|;  
&nbsp;&nbsp;}

event bro\_init()  
&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Input::add\_table([$source="blacklist.file", $name="blacklist", $idx=Idx, $destination=blacklist]);  
&nbsp;&nbsp;schedule 2secs { try\_again() };  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Input::remove("blacklist");  
&nbsp;&nbsp;}

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [November 6, 2013, 6:30pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888/4 "2013-11-06T18:30:50Z")

</div>

This is a bother when running Bro on trace files. Bro will finish processing a trace before reading in an entire table. One hack is to build the table in a separate file and @load it.

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [November 6, 2013, 7:00pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888/5 "2013-11-06T19:00:29Z")

</div>

We also have the exit\_only\_after\_terminate variable to prevent Bro from terminating automatically. You will have to manually kill it if you set this.

redef exit\_only\_after\_terminate = T;

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/load-single-column-table-with-input-framework/2888/6 "2022-05-06T15:41:21Z")

</div>