timesketch
timesketch copied to clipboard
Show amount of events in a saved search on the overview page
It would be great to see in the amount of events that are in a saved view (on the overview page). At this moment you have to click on each individual saved search to see how many events the saved search surfaces, which isn't very user friendly if you're collaborating on a sketch.
This is a great idea and should be pretty simple to implement (just run the query with count and no result). We might want to consider caching the result on the client side though.
@itsmvd is this something that you would like to take on? :)
Yep will do
Would it be "better" to display the number of results in the explore view like we do with data_type and stared events?
Sorry, I did not get time to work on this issue so I've unassigned myself. Having it in on the explore page defeats the purpose of this FR, after all when you're on the explore page you can already see the amount of events in that view.
This is about having a sketch with numerous saved views (which could be created by analyzers, tools, manually etc.) and knowing which ones have events in them and how many, so you can assess which might be useful to click into.
We do not have an overview page anymore, so I move this idea to the future for now.