Export sessions as CSV
arkime_sessions_csvRead-only
Export many Arkime sessions as a compact CSV table, one row each, for reading large result sets as tables without JSON overhead. Filter by time, expression, and limit rows.
Instructions
Export many sessions as a compact CSV table, one row each.
Use this when you want a lot of sessions cheaply: CSV costs far fewer
tokens than the same rows as JSON, so it suits "show me every DNS
session this host made" when you intend to read the result as a table.
Use arkime_sessions instead when you need a session id to drill into
(this returns none), and arkime_connections for a who-talked-to-whom
summary.
Returns raw CSV TEXT with a header row, not JSON. `limit` bounds the
rows exactly. A request naming a column Arkime does not accept hangs
rather than failing, so a timeout is reported as a probable `fields`
problem.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows to export. | |
| fields | No | Comma-separated columns, as ECS DOTTED names ("source.ip,destination.port") — the names malcolm_field_search returns, NOT Arkime db names (srcIp) or expression names (ip.src). A name Arkime does not accept is never reported as an error: it either comes back as an empty column or the request hangs until it times out. Leave empty for Arkime's default columns, which always work. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's default recent window. | |
| expression | No | Arkime expression syntax to scope the rows, e.g. "ip == 192.0.2.7 && protocols == dns". Empty = all sessions. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |