Graph top values over time
arkime_spigraphRead-only
Returns top values for one Arkime field with per-value time series to identify spikes and top talkers.
Instructions
Return top values of ONE Arkime field plus a per-value time-series graph.
Use for top talkers or spotting a value that spikes over time. For
distinct values of one field without the graph use arkime_unique; for a
nested multi-level hierarchy use arkime_spigraphhierarchy; for many
fields profiled at once use arkime_spiview. Returns the raw Arkime
spigraph response (top values with time-bucketed counts).
The bucket width is Arkime's choice, taken from the range asked for and
not exposed as a parameter — measured on Malcolm v26.07.1: 1 second for a
10-minute window, 60 seconds from 30 minutes out to 2 days, an hour at
7 days and wider. Buckets holding no session are left out entirely, so
a 24-hour window came back as 368 buckets rather than 1,440. Compare
the shape of two graphs, never their bucket counts.
An empty items list is HTTP 200 whatever went wrong, but the response
says which: `recordsFiltered` counts the sessions the expression and
window matched, before the field is aggregated. Measured on Malcolm v26.07.1,
field=ip.dst over a window holding data returned 0 items with
recordsFiltered 6,016,935, while field=destination.ip with no time
range returned 0 items with recordsFiltered 0. So a non-zero
recordsFiltered under an empty items list means the FIELD NAME did not
resolve — re-read the `field` description, the storage-path spelling is
the usual cause. Only recordsFiltered 0 is a time-range problem: pass
time_from, since Arkime defaults to a recent-only window that a
historical capture falls outside.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Number of top values to return. It bounds how many distinct values are graphed, never how many time buckets each one is split into — Arkime decides that from the time range. | |
| field | Yes | One Arkime field named by its STORAGE PATH, e.g. "destination.ip", "protocol", "http.host" — arkime_field_search's db column. NOT the exp column: measured on Malcolm v26.07.1 over one 24-hour window, field=destination.ip, field=protocol and field=http.host each filled the requested size, while field=ip.dst, field=protocols, field=dstIp, field=port.dst and field=dstPort each returned 0 — every one of them HTTP 200, so an empty result is the only signal a name was wrong. The db column is the storage path for all but seventeen fields, which print a camelCase alias (srcIp, dstPort, totBytes, dstGEO) and store under the dotted name (source.ip, destination.port, network.bytes, destination.geo.country_iso_code); pass the dotted one for those. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |