Problem
Line 424 in bin/goatsearch.py contains a logic condition that can never evaluate to true:
if latest_seen > 0 and latest_seen == 0:
self.metadata.searchinfo.latest_time = latest_seenThe condition latest_seen > 0 and latest_seen == 0 is a contradiction — a value cannot be both greater than zero and equal to zero simultaneously. This means searchinfo.latest_time is never updated, regardless of the actual latest timestamp seen.
Impact
This appears to affect Splunk's timeline visualization. When latest_time isn't properly set, the search results may not render correctly on the timeline or may show incorrect time boundaries.
Note: The develop branch has already addressed this by removing this dead code block and implementing a different approach via update_earliest_latest().
Root Cause Analysis
This looks like a copy-paste error. Line 421-422 correctly handles earliest_seen:
if earliest_seen > 0:
self.metadata.searchinfo.earliest_time = earliest_seenLine 424 likely was intended to mirror this pattern but was incorrectly modified.
Proposed Fix
Option A (simple):
if latest_seen > 0:
self.metadata.searchinfo.latest_time = latest_seenOption B (consistent with earliest):
if earliest_seen > 0:
self.metadata.searchinfo.earliest_time = earliest_seen
if latest_seen > 0:
self.metadata.searchinfo.latest_time = latest_seenAcceptance Criteria
Related Code
bin/goatsearch.py line 424 (main branch)- Compare with
develop branch approach for reference
Problem
Line 424 in
bin/goatsearch.pycontains a logic condition that can never evaluate to true:The condition
latest_seen > 0 and latest_seen == 0is a contradiction — a value cannot be both greater than zero and equal to zero simultaneously. This meanssearchinfo.latest_timeis never updated, regardless of the actual latest timestamp seen.Impact
This appears to affect Splunk's timeline visualization. When
latest_timeisn't properly set, the search results may not render correctly on the timeline or may show incorrect time boundaries.Note: The
developbranch has already addressed this by removing this dead code block and implementing a different approach viaupdate_earliest_latest().Root Cause Analysis
This looks like a copy-paste error. Line 421-422 correctly handles
earliest_seen:Line 424 likely was intended to mirror this pattern but was incorrectly modified.
Proposed Fix
Option A (simple):
Option B (consistent with earliest):
Acceptance Criteria
latest_timelatest_timeis set when events are yielded (depends on Add end-to-end test infrastructure for CriblSearch #26)Related Code
bin/goatsearch.pyline 424 (main branch)developbranch approach for reference