List unique field combinations
arkime_multiuniqueRead-only
List distinct value combinations across multiple Arkime fields, like source.ip and destination.port, to identify scanning hosts or dense traffic sources.
Instructions
List distinct value COMBINATIONS across a tuple of Arkime fields as plain text.
Like arkime_unique but for a field tuple — e.g. every distinct
(source.ip, destination.port) pair. Good for spotting a host scanning
many ports, or a few talkers behind a lot of traffic. For a single field
use arkime_unique; for a source/destination graph use arkime_connections;
for a nested hierarchy use arkime_spigraphhierarchy. Returns plain TEXT
(one combination per line, not JSON).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| counts | No | Include a per-combination occurrence count (default true). | |
| fields | Yes | Comma-separated Arkime field names forming the tuple, e.g. "source.ip,destination.port". | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |