-
Notifications
You must be signed in to change notification settings - Fork 1
Description
Problem
Line 424 in bin/goatsearch.py contains a logic condition that can never evaluate to true:
if latest_seen > 0 and latest_seen == 0:
self.metadata.searchinfo.latest_time = latest_seenThe condition latest_seen > 0 and latest_seen == 0 is a contradiction — a value cannot be both greater than zero and equal to zero simultaneously. This means searchinfo.latest_time is never updated, regardless of the actual latest timestamp seen.
Impact
This appears to affect Splunk's timeline visualization. When latest_time isn't properly set, the search results may not render correctly on the timeline or may show incorrect time boundaries.
Note: The develop branch has already addressed this by removing this dead code block and implementing a different approach via update_earliest_latest().
Root Cause Analysis
This looks like a copy-paste error. Line 421-422 correctly handles earliest_seen:
if earliest_seen > 0:
self.metadata.searchinfo.earliest_time = earliest_seenLine 424 likely was intended to mirror this pattern but was incorrectly modified.
Proposed Fix
Option A (simple):
if latest_seen > 0:
self.metadata.searchinfo.latest_time = latest_seenOption B (consistent with earliest):
if earliest_seen > 0:
self.metadata.searchinfo.earliest_time = earliest_seen
if latest_seen > 0:
self.metadata.searchinfo.latest_time = latest_seenAcceptance Criteria
- Logic corrected to properly update
latest_time - Test validating that
latest_timeis set when events are yielded (depends on Add end-to-end test infrastructure for CriblSearch #26)
Related Code
bin/goatsearch.pyline 424 (main branch)- Compare with
developbranch approach for reference