List unique field combinations
arkime_multiuniqueRead-only
List distinct combinations of Arkime field values to uncover patterns like a host scanning many ports. Returns plain text with counts, scoped by expression or time range.
Instructions
List distinct value COMBINATIONS across a tuple of Arkime fields as plain text.
Like arkime_unique but for a field tuple — e.g. every distinct
(source.ip, destination.port) pair. Good for spotting a host scanning
many ports, or a few talkers behind a lot of traffic. For a single field
use arkime_unique; for a source/destination graph use arkime_connections;
for a nested hierarchy use arkime_spigraphhierarchy. Returns plain TEXT
(one combination per line, not JSON).
"(no values)" with no time range usually means the data predates
Arkime's default recent window rather than being absent: pass
time_from. Every field added multiplies the rows, well past the 10,000
values arkime_unique stops at — measured on Malcolm v26.07.1 over one 24-hour
window, a two-field tuple returned 22,548 lines and a three-field tuple
50,817, about 2 MB of text. Scope it with expression first, or size the
match with
arkime_sessions_summary before asking for the tuples.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| counts | No | Include a per-combination occurrence count (default true). | |
| fields | Yes | Comma-separated Arkime field names forming the tuple, e.g. "source.ip,destination.port". | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |