List indexed PCAP files
arkime_pcap_filesRead-only
Discover what PCAP files are indexed, including file size, session count, and time span, to verify capture coverage and identify gaps.
Instructions
List the PCAP files Arkime has indexed, with each file's coverage.
Use this to answer "what capture do we actually hold" — which files
exist, how big they are, how many sessions each carries and the time
span it covers. That is the file-level view; for the dataset-level view
(how fresh each sensor is, how many documents per log type) use
malcolm_data_coverage, and to search the sessions themselves use
arkime_sessions.
On one node, an interval between a file's last packet and the next
file's first is an interval with no captured packets, and no search can
tell you whether the link was quiet or the capture was down — this list
is the only place that distinction shows up. Files from different nodes
overlap in time, so compare within a node. Per-file fields and their
units are in the output schema.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max files to return. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |