diff --git a/timesketch/api/v1/resources/aggregation.py b/timesketch/api/v1/resources/aggregation.py index 1b25827e34..de3d13064a 100644 --- a/timesketch/api/v1/resources/aggregation.py +++ b/timesketch/api/v1/resources/aggregation.py @@ -468,7 +468,7 @@ def post(self, sketch_id): sketch_indices = { t.searchindex.index_name for t in sketch.timelines - if t.get_status.status.lower() == "ready" + if t.get_status.status.lower() in ["ready", "processing"] } aggregation_dsl = form.aggregation_dsl.data diff --git a/timesketch/api/v1/resources/explore.py b/timesketch/api/v1/resources/explore.py index c45a917f87..f2b38a4149 100644 --- a/timesketch/api/v1/resources/explore.py +++ b/timesketch/api/v1/resources/explore.py @@ -142,7 +142,9 @@ def post(self, sketch_id): query_filter = request.json.get("filter", {}) parent = request.json.get("parent", None) incognito = request.json.get("incognito", False) - + include_processing_timelines = request.json.get( + "includeProcessingTimelines", False + ) return_field_string = form.fields.data if return_field_string: return_fields = [x.strip() for x in return_field_string.split(",")] @@ -163,7 +165,9 @@ def post(self, sketch_id): # Make sure that the indices in the filter are part of the sketch. # This will also remove any deleted timeline from the search result. - indices, timeline_ids = get_validated_indices(indices, sketch) + indices, timeline_ids = get_validated_indices( + indices, sketch, include_processing_timelines + ) # Remove indices that don't exist from search. indices = utils.validate_indices(indices, self.datastore) diff --git a/timesketch/frontend-ng/src/components/Explore/EventList.vue b/timesketch/frontend-ng/src/components/Explore/EventList.vue index 53918775e7..dd993ce079 100644 --- a/timesketch/frontend-ng/src/components/Explore/EventList.vue +++ b/timesketch/frontend-ng/src/components/Explore/EventList.vue @@ -15,6 +15,15 @@ limitations under the License. -->