Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat(cli): Add field count to Timesketch index information #3274

Merged
merged 2 commits into from
Feb 7, 2025

Conversation

jaegeral
Copy link
Collaborator

This pull request enhances the Timesketch CLI client by adding the ability to display the number of fields present in each index associated with a sketch. This provides users with valuable information about the structure of their data directly from the command line, improving their workflow when working with Timesketch.

Key changes:

  • Calculated the number of fields based on the retrieved mapping data.
  • Modified the CLI output for sketch/index information to include the fields.
timesketch --sketch 16 timelines describe 18
Name: 2
Index: dd9b6f91f8a04018a44afcb82d762c8d
Status: ready
Event count: 200
Color: F379E1
Number of fields: 407
Name: 2
Created: 2025-01-31T11:01:28.693660
Datasources:
	Original filename:
	File on disk:
	Error:
	Original filename:
	File on disk:
	Error:

@jaegeral jaegeral requested a review from jkppr January 31, 2025 12:14
@jkppr
Copy link
Collaborator

jkppr commented Feb 1, 2025

Should we make it transparent that the searchindex can contain more than one timeline and therefore the field number does not represent all fields in the timeline but in the searchindex?

Copy link
Collaborator

@jkppr jkppr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

otherwise, lgtm

@jaegeral jaegeral merged commit 5e684a4 into google:master Feb 7, 2025
24 checks passed
@jaegeral jaegeral deleted the 2025-01-31_cli_number_of_fields branch February 10, 2025 10:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants