Size a session set before acting on it
arkime_sessions_summaryRead-only
Get total sessions, bytes, packets, and per-field breakdowns for any Arkime expression in one call. Use it to size result sets before heavy actions or to avoid count dialect switches.
Instructions
Total sessions, bytes and packets for an expression, plus per-field breakdowns.
Sizes a result set in one call, before something expensive acts on it.
It is what arkime_create_hunt's total_sessions wants, in one call and
in the same dialect — count means a dialect switch, and neither count
nor arkime_sessions reports bytes or packets. For the matching sessions
themselves use arkime_sessions, and for a value distribution without
the totals use arkime_unique or arkime_spiview.
Returns JSON {"totals", "breakdowns"}: totals carry sessions, bytes,
dataBytes, packets and the first/last packet timestamps (Arkime's empty
histogram scaffolding is dropped); each breakdown carries its field name
and its top values with per-value session/byte/packet counts. An
expression that matches nothing is a successful answer, not an error:
the totals read 0 and every field asked for still comes back as a
breakdown with an empty `data` list — measured with
"ip == 203.0.113.99" over 1714003200-1714089600. A field Arkime declined
to break down is listed in ignored_fields rather than passed over in
silence, since upstream reports it the same way as a field with no
values.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Comma-separated fields to break the totals down by, one breakdown each, e.g. "protocols,ip.dst". Arkime expression names ("ip.src") and dotted ECS names ("source.ip") both work; a db name ("srcIp") is silently ignored upstream and is reported back in ignored_fields. Cannot be empty — Arkime rejects the request without it — so an empty value falls back to protocols. | protocols |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty summarises Arkime's default recent window, which on a historical capture reports zero and looks like a broken tool. | |
| expression | No | Arkime expression syntax scoping what is counted, e.g. "protocols == http && ip.dst == 203.0.113.5". Empty counts every session in the window. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |