Session Unique Values
session-unique-valuesRetrieve distinct values for a session field (e.g., source IP) within a time range, with optional per-value counts. Filter sessions using a Lucene query.
Instructions
Return the distinct values of a single session field over a time range (server produces a CSV). Optionally include per-value counts. Useful for extracting distinct IPs, ports, or other field values matching a query.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | Field to get unique values for (e.g. source.ip) | |
| query | No | Lucene query string to filter sessions | |
| scope | No | Data scope: workspace (default) or demo | |
| end_time | Yes | End time, ISO 8601 (e.g. 2025-01-07T23:59:59Z) | |
| start_time | Yes | Start time, ISO 8601 (e.g. 2025-01-01T00:00:00Z) | |
| include_counts | No | Include per-value counts in the output (default: false) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| rows | No | ||
| field | Yes | ||
| total | No | ||
| values | Yes | ||
| include_counts | No |