Tab Character Variable

Zeek
1

I’m writing a script to read from a tsv file containing blacklisted IPs (Input::add_table, using reread mode) and then append new IPs to the end of the same file. I can read the file just fine, but any time I try to write out “\t” or “\x09”, the output shows up as “^I”. That goes for the system() function to write to the file as well as just using print within the script. Does anyone know how to send the tab character properly?

Alternatively:

A) I could change to csv, but I don’t know how to change the input separator to allow for this.
B) I am using a second column that’s basically just filler in order to use add_table like the example on the blog. Is there a way to just import a one-column table?

Thanks

2

Trying using the logging framework instead of printing directly to a file.
Grep for ‘const separator’ in base/frameworks/logging for changing the default column separator.

-AK

3

Yes, this sounds like it would be the better solution.

But - just for reference - enable_raw_output should solve the print-problem.

http://www.bro.org/sphinx/scripts/base/bif/bro.bif.html#id-enable_raw_output

Johanna