If I put the following code inside the export section, would I be changing the separator for all subsequently loaded scripts as well?
ex.
export{
redef InputAscii::separator = “,”;
}
Whereas if I put it outside the export block, would it only be changed for my script and not apply to another?
export{
#foo here
}
redef InputAscii::separator = “,”;
Additionally, when you are redefining variables, why is it that redef enum is necessary when redefining an enumerable type whereas no other variable requires the type to be explicitly stated for the redefinition (i.e. strings as above).
Hi Arash,
it will always be changed for all scripts.
As for redef enum - it actually is also necessary for record types (you will find a lot of "redef record" in Bro scripts. However, it would probably be possible to get rid of those as the parser should, in theory, be able to determine the type by itself. I did not write that code, but I think it is just a Bro syntax quirk that might also make writing parsing a bit easier.
Johanna
Thanks Johanna,
Unfortunately, that would break functionality in a myriad of other scripts. Is there a more elegant solution to this problem than redefining the separator after the end of the Input::end_of_data event is triggered? Since input is performed through an asynchronous call, it is not guaranteed that the change to the separator would be reverted before another file is read by Bro.
Hi Arash,
Yup, you actually can specify the separator per by passing it
as a configuration option (named separator).
You could, e.g. do something like this:
local config_strings: table[string] of string = {
["separator"] = ";",
};
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers, $config=config_strings]);
I hope this helps,
Johanna
Thank you very much.
I’m still going over the documentation as I’m very much new to Bro scripting. Once again, thanks for your help.