[
https://bro-tracker.atlassian.net/browse/BIT-1453?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=21605#comment-21605
]
Johanna Amann commented on BIT-1453:
------------------------------------
Sorry, I still cannot reproduce this. Running your exact script using your
exact file from model2.log.txt works flawlessly for me.
What version of Bro are you using? Could you please cross-check that in the
actual file that you use, there are all tabs in the #fields line? (In your
example in model2.log.txt, they are -- so I assume they are in your real data
too, just crossing all t's).
> Input::add_table is not properly reading in sets
> ------------------------------------------------
>
> Key: BIT-1453
> URL: https://bro-tracker.atlassian.net/browse/BIT-1453
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: 2.4
> Environment: ArchLinux on VMware
> Reporter: earl eiland
> Assignee: Johanna Amann
> Labels: Input::add_table
> Attachments: input.bro, input.log, model2.log.txt
>
>
> I’m reading a table into a script. The table includes two sets in the values
> fields. When executing the script, I’m getting the error message ”Did not
> find requested field service in input data file model2.log”
> Following the example in
> bro/testing/btest/scripts/base/frameworks/input/setseparator.bro, I’ve
> redefined the set separator as ‘|’ (redef InputAscii::set_separator = "|";).
> The
> The table key consists of two addresses, node_A and node_B.
> My value inputs consist of two sets, which can consist of just a single
> value; all fields are separated by tabs. The first two lines of my input
> file are:
> #fields node_A node_B
> layer_3_4 service
> xxx.yyy.zzz.30 xxx.yyy.255.255 udp dns
> xxx.yyy.zzz are valid IP address values.
> It appears that the strings ‘udp’ and ‘dns’ are both being read as part of
> the layer_3_4 set. Since they are separated by a tab instead of ‘|’, they
> should be interpreted as separate fields.
--
This message was sent by Atlassian JIRA
(v6.5-OD-08-001#65007)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
