Size a session set before acting on it
arkime_sessions_summaryRead-only
Summarize total sessions, bytes, and packets for an Arkime expression, with per-field breakdowns, to size a result set before expensive follow-up actions.
Instructions
Total sessions, bytes and packets for an expression, plus per-field breakdowns.
Sizes a result set in one call, before something expensive acts on it.
It is what arkime_create_hunt's total_sessions wants, in one call and
in the same dialect — count means a dialect switch, and neither count
nor arkime_sessions reports bytes or packets. For the matching sessions
themselves use arkime_sessions, and for a value distribution without
the totals use arkime_unique or arkime_spiview.
Returns JSON {"totals", "breakdowns"}: totals carry sessions, bytes,
dataBytes, packets and the first/last packet timestamps (Arkime's empty
histogram scaffolding is dropped); each breakdown carries its field name
and its top values with per-value session/byte/packet counts. An
expression that matches nothing is a successful answer, not an error:
the totals read 0 and every field asked for still comes back as a
breakdown with an empty `data` list — measured with
"ip == 203.0.113.99" over 1714003200-1714089600. A field Arkime declined
to break down is listed in ignored_fields rather than passed over in
silence, since upstream reports it the same way as a field with no
values.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Comma-separated fields to break the totals down by, one breakdown each, e.g. "protocols,ip.dst". Arkime expression names ("ip.src") and dotted ECS names ("source.ip") both work; a db name ("srcIp") is silently ignored upstream and is reported back in ignored_fields. Cannot be empty — Arkime rejects the request without it — so an empty value falls back to protocols. | protocols |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty summarises Arkime's default recent window, which on a historical capture reports zero and looks like a broken tool. | |
| expression | No | Arkime expression syntax scoping what is counted, e.g. "protocols == http && ip.dst == 203.0.113.5". Empty counts every session in the window. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |