Bad pin starting at commit 7046367

[philrz]

I came across this while going through our regular demo flow for the first time in a while. I narrowed down the symptom as appearing starting at Brim commit 7046367 (associated with #1049, cc: @jameskerr) but it reproduces the same in current Brim master, which is commit 5f46417 at the moment.

Repro is shown in the video below and described in the steps.

Repro.zip

Repro steps:

1. Start with the Zeek logs associated with the common all.pcap test data
2. Create individual pinned items for search terms 192.168.0.51 and _path=http
3. Execute variations on additional search terms GET, OPTIONS, POST
4. Change the History mode from Linear to Tree
5. Click on the pin for 192.168.0.51, change it to 192.168.0.53, and re-execute the search

The problem you can see in the History panel is that the lowest level search term now shows 192.168.0.53. Prior to commit 7046367, that same entry would show POST.

[philrz]

Verified in Brim commit 07dda7a talking to zqd commit 0c6b642.

As shown in the attached video, when repeating the original repro steps, what's saved shown in the Tree at the end now correctly reflects the "POST" entry being the final element of the newly-created branch in the History.

Verify.zip

Thanks @jameskerr!