search

google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.58k stars 589 forks source link

Add timesketch internal fieldnames to search query guide #2794

Open jaegeral opened 1 year ago

jaegeral commented 1 year ago

A very common question is how to use internal TS field names like __ts_star in queries.

They should be covered in https://timesketch.org/guides/user/search-query-guide/#examples

Jeyakumar-M commented 9 months ago

Hi @jaegeral is this issue still open for work? I'm just a beginner to opensource. can I try my best to solve this issue?

jaegeral commented 9 months ago

Sure thing, go ahead, lmk if you have any question

Jeyakumar-M commented 9 months ago

@jaegeral sir is the query is __ts_star or star. I think queries like star:"true" is used to find events that have been starred or star:"false" for events that have not been starred. But sorry to say this I can't get about __ts_star. If I understood anything incorrectly I kindly request you to guide me.

Abhishek-jha-96 commented 3 months ago

@jaegeral does encoding fields like "__ts_star" at frontend and decoding it at the backend seems a valid option? (If yes would I like to pick up this issue)