Search Arkime sessions
arkime_sessionsRead-only
Search Arkime sessions with an expression to obtain session IDs for drill-down into details, PCAP, payload, files, and tags.
Instructions
Search Arkime sessions by expression; returns trimmed rows each carrying a session id.
This is the ONLY search returning a session id, and every
session-scoped tool needs one: arkime_session_detail,
arkime_session_pcap, arkime_session_payload,
arkime_session_file_by_hash and arkime_add_tags. For one session's own
row use arkime_session_detail; for its PCAP bytes/metadata use
arkime_session_pcap. To search with Malcolm filter dicts and dateparser
times instead of Arkime expressions and epoch seconds, use
malcolm_search. Returns `matched` (how many sessions the expression
found, which is usually far more than are returned), `showing`, and the
session rows. Each row's `id` is what the drill-down tools take.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max sessions to return. Each row is a JSON object carrying its own keys, which is why this stops at 100; when you want thousands of rows and no session id, arkime_sessions_csv takes up to 10,000. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string like "7 days ago"). Empty = Arkime's recent-only default; pass a range for historical data. | |
| expression | Yes | Arkime expression syntax (NOT OpenSearch DSL, NOT a Malcolm filter dict). Examples: "ip==192.0.2.77"; "ip.src==192.0.2.77 && ip.dst==198.51.100.1"; "protocols==dns"; "port.dst==443"; "http.uri==/login*"; "country.dst==CN". Every clause must be field-operator-value — there is no free-text search. Field existence is the literal token EXISTS!, as in "zeek.ftp.password == EXISTS!". A list is an OR: "port == [80,443]". Field names are Arkime's own, NOT the ECS names malcolm_field_search returns — look them up with arkime_field_search. A name Arkime cannot resolve is not an error: measured on Malcolm v26.07.1, "nosuch.field==1" over a window holding 6M sessions answered matched:0 with no marker, indistinguishable from a query that genuinely found nothing. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |