timesketch
timesketch copied to clipboard
Unexpected Column returned with API client sketch.explore return_fields
Using the pip installed timesketch api client, the following commands gave me an unexpected column:
from timesketch_api_client import config
ts_client = config.get_client()
return = sketch.explore('1.2.3.4', as_pandas=True,return_fields='Source,Destination')
The following pandas was returned:
return.info()
<class 'pandas.core.frame.DataFrame'>
RangeIndex: 224669 entries, 0 to 224668
Data columns (total 3 columns):
# Column Non-Null Count Dtype
--- ------ -------------- -----
0 **label** 224669 non-null object
1 Destination 224650 non-null object
2 Source 224650 non-null object
Imho it should not return the label column if not specified.
@kiddinn do you plan to work on this or should we un-assign you?
Probably better to leave it unassigned