(self, label, sketch)
return export.query_results_to_dataframe(result, sketch)
Returns a DataFrame with events in a sketch with a certain label.

        Args:
            label (string): the label string to search for.
            sketch (timesketch.models.sketch.Sketch): a sketch object.

        Returns:
            pd.DataFrame: a pandas DataFrame with all the events in the
                datastore that have a label.
Returns a DataFrame with events in a sketch with a certain label.
Returns a DataFrame with events in a sketch with a certain label .
def _get_all_events_with_a_label(self, label, sketch):
        """Returns a DataFrame with events in a sketch with a certain label.

        Args:
            label (string): the label string to search for.
            sketch (timesketch.models.sketch.Sketch): a sketch object.

        Returns:
            pd.DataFrame: a pandas DataFrame with all the events in the
                datastore that have a label.
        """
        query_dsl = {
            'query': {
                'nested': {
                    'path': 'timesketch_label',
                    'query': {
                        'bool': {
                            'must': [{
                                'term': {
                                    'timesketch_label.name': label
                                }
                            }, {
                                'term': {
                                    'timesketch_label.sketch_id': sketch.id
                                }
                            }]
                        }
                    }
                }
            }
        }
        result = self.datastore.search(
            sketch_id=sketch.id,
            query_string='',
            query_filter=self.DEFAULT_QUERY_FILTER,
            query_dsl=json.dumps(query_dsl),
            indices=self.sketch_indices)

        return export.query_results_to_dataframe(result, sketch)
def _get_all_events_with_a_label ( self , label , sketch ) : query_dsl = { 'query' : { 'nested' : { 'path' : 'timesketch_label' , 'query' : { 'bool' : { 'must' : [ { 'term' : { 'timesketch_label.name' : label } } , { 'term' : { 'timesketch_label.sketch_id' : sketch . id } } ] } } } } } result = self . datastore . search ( sketch_id = sketch . id , query_string = '' , query_filter = self . DEFAULT_QUERY_FILTER , query_dsl = json . dumps ( query_dsl ) , indices = self . sketch_indices ) return export . query_results_to_dataframe ( result , sketch )