Graph top values over time
arkime_spigraphRead-only
Graph top values of one Arkime field with a per-value time-series graph to spot top talkers or value spikes over time.
Instructions
Return top values of ONE Arkime field plus a per-value time-series graph.
Use for top talkers or spotting a value that spikes over time. For
distinct values of one field without the graph use arkime_unique; for a
nested multi-level hierarchy use arkime_spigraphhierarchy; for many
fields profiled at once use arkime_spiview. Returns the raw Arkime
spigraph response (top values with time-bucketed counts).
The bucket width is Arkime's choice, taken from the range asked for and
not exposed as a parameter: it widens as the range does. Buckets holding
no session are left out entirely, so a window returns fewer buckets
than its width divides into. Compare the shape of two graphs, never
their bucket counts.
An empty items list is HTTP 200 whatever went wrong, but the response
says which: `recordsFiltered` counts the sessions the expression and
window matched, before the field is aggregated. field=ip.dst over a
window holding data returns 0 items with a non-zero recordsFiltered,
while field=destination.ip with no time range can return 0 items with
recordsFiltered 0. So a non-zero
recordsFiltered under an empty items list means the FIELD NAME did not
resolve — re-read the `field` description, the storage-path spelling is
the usual cause. Only recordsFiltered 0 is a time-range problem: pass
time_from, since Arkime defaults to a recent-only window that a
historical capture falls outside.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Number of top values to return. It bounds how many distinct values are graphed, never how many time buckets each one is split into — Arkime decides that from the time range. | |
| field | Yes | One Arkime field named by its STORAGE PATH, e.g. "destination.ip", "protocol", "http.host" — arkime_field_search's db column. NOT the exp column: field=destination.ip, field=protocol and field=http.host fill the requested size, while field=ip.dst, field=protocols, field=dstIp, field=port.dst and field=dstPort each return 0 — every one of them HTTP 200, so an empty result is the only signal a name was wrong. The db column is the storage path for all but a few fields, which print a camelCase alias (srcIp, dstPort, totBytes, dstGEO) and store under the dotted name (source.ip, destination.port, network.bytes, destination.geo.country_iso_code); pass the dotted one for those. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |