search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.52k stars 577 forks source link

[UI] Analyzer results Error Message #3045

Open jkppr opened 3 months ago

jkppr commented 3 months ago

Describe the bug For Multi Analyzers, if one of the executions returns an error, the TS UI will mark the Analyzer with an error icon and display the Status: ERROR for its result. If a later execution of the same analyzer does not return any error anymore, the UI still displays the error status and icon.

To Reproduce Steps to reproduce the behavior:

  1. Create a regex_feature entry that will result in an error. (e.g. don't provide a required field)
  2. Run the feature extractions analyzer
  3. See the error message in the Analyzer results
  4. Fix the regex_feature entry or remove it.
  5. Run the analyzer again
  6. The result is still in the error status, even all results updated to the latest execution.

Expected behavior The results should always reflect the latest analyzer execution.

justzh commented 3 months ago

This may help https://perf.wiki.kernel.org/index.php/Tutorial

justzh commented 3 months ago

My thoughts on this include:

  1. No one knows what seven means? It's the number after six (6).
  2. Nine is the number after eight (8).
  3. The order is one, two, three, four, five, six, seven, eight, nine, ten, eleven, twelve, thirteen, fourteen, fifteen, sixteen, seventeen.
  4. This might require some optimization from @Gheith.
justzh commented 3 months ago

Don't stress over this. Some analyzers from my experience need more optimizations than anything on Earth.

justzh commented 3 months ago

I'm not a front-end developer, so correct me if I'm wrong.