(
            self, label_name, return_fields=None, max_entries=None,
            as_pandas=False)
return self.explore(
            query_dsl=json.dumps({'query': query}), return_fields=return_fields,
            max_entries=max_entries, as_pandas=as_pandas)
Searches for all events containing a given label.

        Args:
            label_name: A string representing the label to search for.
            return_fields (str): A comma separated string with a list of fields
                that should be included in the response. Optional and defaults
                to None.
            max_entries (int): Optional integer denoting a best effort to limit
                the output size to the number of events. Events are read in,
                10k at a time so there may be more events in the answer back
                than this number denotes, this is a best effort.
            as_pandas: Optional bool that determines if the results should
                be returned back as a dictionary or a Pandas DataFrame.

        Returns:
            A dictionary with query results.
Searches for all events containing a given label.
Searches for all events containing a given label .
def search_by_label(
            self, label_name, return_fields=None, max_entries=None,
            as_pandas=False):
        """Searches for all events containing a given label.

        Args:
            label_name: A string representing the label to search for.
            return_fields (str): A comma separated string with a list of fields
                that should be included in the response. Optional and defaults
                to None.
            max_entries (int): Optional integer denoting a best effort to limit
                the output size to the number of events. Events are read in,
                10k at a time so there may be more events in the answer back
                than this number denotes, this is a best effort.
            as_pandas: Optional bool that determines if the results should
                be returned back as a dictionary or a Pandas DataFrame.

        Returns:
            A dictionary with query results.
        """
        if self.is_archived():
            raise RuntimeError(
                'Unable to search for labels in an archived sketch.')

        logger.warning(
            'This function will be deprecated soon. Use the search.Search '
            'object instead and add a search.LabelChip to search for labels.')

        query = {
            'nested': {
                'path': 'timesketch_label',
                'query': {
                    'bool': {
                        'must': [
                            {
                                'term': {
                                    'timesketch_label.name': label_name
                                }
                            },
                            {
                                'term': {
                                    'timesketch_label.sketch_id': self.id
                                }
                            }
                        ]
                    }
                }
            }
        }
        return self.explore(
            query_dsl=json.dumps({'query': query}), return_fields=return_fields,
            max_entries=max_entries, as_pandas=as_pandas)
def search_by_label ( self , label_name , return_fields = None , max_entries = None , as_pandas = False ) : if self . is_archived ( ) : raise RuntimeError ( 'Unable to search for labels in an archived sketch.' ) logger . warning ( 'This function will be deprecated soon. Use the search.Search ' 'object instead and add a search.LabelChip to search for labels.' ) query = { 'nested' : { 'path' : 'timesketch_label' , 'query' : { 'bool' : { 'must' : [ { 'term' : { 'timesketch_label.name' : label_name } } , { 'term' : { 'timesketch_label.sketch_id' : self . id } } ] } } } } return self . explore ( query_dsl = json . dumps ( { 'query' : query } ) , return_fields = return_fields , max_entries = max_entries , as_pandas = as_pandas )