fix: map __ts_timeline_id to timeline name in to_pandas

api_client/python/timesketch_api_client/search.py

@@ -1164,10 +1164,18 @@ def to_pandas(self):
                 source["_type"] = result.get("_type")
             if not return_fields or "_index" in return_field_list:
                 source["_index"] = result.get("_index")
+            raw_timeline_id = source.get("__ts_timeline_id")
+            timeline_id = raw_timeline_id
+            if timeline_id is not None:
+                try:
+                    timeline_id = int(timeline_id)
+                except (TypeError, ValueError):
+                    pass
+            timeline_name = timelines.get(timeline_id, raw_timeline_id)
             if not return_fields or "_source" in return_field_list:
-                source["_source"] = timelines.get(result.get("__ts_timeline_id"))
+                source["_source"] = timeline_name
             if not return_fields or "__ts_timeline_id" in return_field_list:
-                source["_source"] = timelines.get(result.get("__ts_timeline_id"))
+                source["__ts_timeline_id"] = timeline_name
 
             return_list.append(source)
 

api_client/python/timesketch_api_client/search_test.py

@@ -56,6 +56,40 @@ def test_from_manual(self):
         objects = search_dict.get("objects", [])
         self.assertEqual(len(objects), 1)
 
+    def test_to_pandas_timeline_fields(self):
+        """Test that to_pandas maps timeline fields to timeline names."""
+        search_obj = search.Search(sketch=self.sketch)
+        search_obj.return_fields = "message,_source,__ts_timeline_id"
+        # pylint: disable=protected-access
+        search_obj._raw_response = {
+            "objects": [
+                {
+                    "_source": {"message": "foo", "__ts_timeline_id": 1},
+                    "_id": "a1",
+                    "_type": "generic_event",
+                    "_index": "test",
+                },
+                {
+                    "_source": {"message": "bar", "__ts_timeline_id": "2"},
+                    "_id": "a2",
+                    "_type": "generic_event",
+                    "_index": "test",
+                },
+                {
+                    "_source": {"message": "baz", "__ts_timeline_id": "999"},
+                    "_id": "a3",
+                    "_type": "generic_event",
+                    "_index": "test",
+                },
+            ]
+        }
+        data_frame = search_obj.to_pandas()
+        self.assertEqual(
+            list(data_frame.columns), ["message", "__ts_timeline_id", "_source"]
+        )
+        self.assertEqual(list(data_frame["_source"]), ["test", "test", "999"])
+        self.assertEqual(list(data_frame["__ts_timeline_id"]), ["test", "test", "999"])
+
     def test_range_chip(self):
         """Test date range chip."""
         chip = search.DateRangeChip()