Skip to content

Fix unreachable code in latest_time metadata update #30

@JacobPEvans

Description

@JacobPEvans

Problem

Line 424 in bin/goatsearch.py contains a logic condition that can never evaluate to true:

if latest_seen > 0 and latest_seen == 0:
    self.metadata.searchinfo.latest_time = latest_seen

The condition latest_seen > 0 and latest_seen == 0 is a contradiction — a value cannot be both greater than zero and equal to zero simultaneously. This means searchinfo.latest_time is never updated, regardless of the actual latest timestamp seen.

Impact

This appears to affect Splunk's timeline visualization. When latest_time isn't properly set, the search results may not render correctly on the timeline or may show incorrect time boundaries.

Note: The develop branch has already addressed this by removing this dead code block and implementing a different approach via update_earliest_latest().

Root Cause Analysis

This looks like a copy-paste error. Line 421-422 correctly handles earliest_seen:

if earliest_seen > 0:
    self.metadata.searchinfo.earliest_time = earliest_seen

Line 424 likely was intended to mirror this pattern but was incorrectly modified.

Proposed Fix

Option A (simple):

if latest_seen > 0:
    self.metadata.searchinfo.latest_time = latest_seen

Option B (consistent with earliest):

if earliest_seen > 0:
    self.metadata.searchinfo.earliest_time = earliest_seen

if latest_seen > 0:
    self.metadata.searchinfo.latest_time = latest_seen

Acceptance Criteria

Related Code

  • bin/goatsearch.py line 424 (main branch)
  • Compare with develop branch approach for reference

Metadata

Metadata

Assignees

Labels

bugSomething isn't workinggood first issueGood for newcomers

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions