List saved Arkime value lists
arkime_shortcutsRead-only
Lists Arkime's named value lists (IOC sets) with their contents, so you can reference existing lists in expressions.
Instructions
List Arkime's named value lists (IOC sets) and what each one contains.
A shortcut is a named list of IPs, strings or numbers that an expression
can reference as `$name` instead of spelling every value out. Use this
before writing an expression so you reference a list that exists and
know what is in it. For saved queries rather than value lists use
arkime_views, for scheduled queries that stamp their own tags use
arkime_crons, and to add a list of your own use arkime_create_shortcut
(needs the arkime-view write class).
Arkime scopes shortcuts by owner and role the same way it scopes views:
its API filters the list by the requesting user and that user's roles,
so this shows what the configured account can see, not everything on the
server, and a name an expression then rejects as unknown may simply
belong to someone else. That is Arkime's documented API behaviour rather
than something measured here: Malcolm v26.07.1 ships no shortcut, so an
empty list is the expected answer on a fresh deployment.
Field meanings are in the output schema; use_in_expression is the token
to paste, already spelled correctly.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max shortcuts to return. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |