Session Counts
session-countsRead-only
Group and count network sessions by one or more fields over a time range, supporting nested drill-down buckets and optional Lucene query filtering.
Instructions
Aggregate session counts grouped by one or more fields over a time range. Multiple fields produce nested (drill-down) buckets.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Buckets per aggregation level, 1-100 (default: 10) | |
| query | No | Lucene query string to filter sessions | |
| scope | No | Data scope: workspace (default) or demo | |
| fields | Yes | Comma-separated fields to aggregate on (e.g. source.ip,destination.port) | |
| end_time | Yes | End time, ISO 8601 (e.g. 2025-01-07T23:59:59Z) | |
| start_time | Yes | Start time, ISO 8601 (e.g. 2025-01-01T00:00:00Z) |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| items | No | ||
| total | No | ||
| request_metadata | No |