Export sessions as CSV
arkime_sessions_csvRead-only
Export network sessions as compact CSV to cut token usage on large queries. Use for table-readable results like all DNS sessions from a host.
Instructions
Export many sessions as a compact CSV table, one row each.
Use this when you want a lot of sessions cheaply: CSV costs roughly half
the tokens of the same rows as JSON, so it suits "show me every DNS
session this host made" when you intend to read the result as a table.
Use arkime_sessions instead when you need a session id to drill into
(this returns none), and arkime_connections for a who-talked-to-whom
summary.
Returns raw CSV TEXT with a header row, not JSON. `limit` bounds the
rows exactly. A request naming a column Arkime does not accept hangs
rather than failing, so a timeout is reported as a probable `fields`
problem.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows to export. | |
| fields | No | Comma-separated columns, as ECS DOTTED names ("source.ip,destination.port") — the names malcolm_field_search returns, NOT Arkime db names (srcIp) or expression names (ip.src). A name Arkime does not accept is never reported as an error: measured on Arkime 6.6.0 it either comes back as an empty column or the request hangs until it times out. Leave empty for Arkime's default columns, which always work. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's default recent window. | |
| expression | No | Arkime expression syntax to scope the rows, e.g. "ip == 192.0.2.7 && protocols == dns". Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |