Search Arkime sessions
arkime_sessionsRead-only
Search Arkime sessions by expression to return matching rows and the session IDs required by drill-down tools like detail and PCAP.
Instructions
Search Arkime sessions by expression; returns trimmed rows each carrying a session id.
This is the ONLY search returning a session id, and every
session-scoped tool needs one: arkime_session_detail,
arkime_session_pcap, arkime_session_payload,
arkime_session_file_by_hash and arkime_add_tags. For one session's own
row use arkime_session_detail; for its PCAP bytes/metadata use
arkime_session_pcap. To search with Malcolm filter dicts and dateparser
times instead of Arkime expressions and epoch seconds, use
malcolm_search. Returns `matched` (how many sessions the expression
found, which is usually far more than are returned), `showing`, and the
session rows. Each row's `id` is what the drill-down tools take.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max sessions to return. Each row is a JSON object carrying its own keys, which is why this stops at 100; when you want thousands of rows and no session id, arkime_sessions_csv takes up to 10,000. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string like "7 days ago"). Empty = Arkime's recent-only default; pass a range for historical data. | |
| expression | Yes | Arkime expression syntax (NOT OpenSearch DSL, NOT a Malcolm filter dict). Examples: "ip==192.0.2.77"; "ip.src==192.0.2.77 && ip.dst==198.51.100.1"; "protocols==dns"; "port.dst==443"; "http.uri==/login*"; "country.dst==CN". Every clause must be field-operator-value — there is no free-text search. Field existence is the literal token EXISTS!, as in "zeek.ftp.password == EXISTS!". A list is an OR: "port == [80,443]". Field names are Arkime's own, NOT the ECS names malcolm_field_search returns — look them up with arkime_field_search. A name Arkime cannot resolve, or an expression it cannot parse, is reported as an error carrying Arkime's own message. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |