search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.67k stars 8.23k forks source link

[Security Solution] [Timeline] Load partial results as soon as they are available #194162

Open kqualters-elastic opened 1 month ago

kqualters-elastic commented 1 month ago

When using timeline pinned events, if a data view has a mix of hot-frozen indices, timeline will not display any data until all backing indices are searched. This can result in frustrating ux, unnecessarily so. Instead, timeline should display results as soon as they are available. This would require slight changes in both the search strategy server side as well as the frontend.

elasticmachine commented 1 month ago

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)